stacklok / toolhive / 43218364203

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add the actor-token validator hook for ID-JAG issuance (#7116)

* Add the actor-token validator interface

ID-JAG issuance needs to name the acting agent in the act claim, but
the issuing server cannot see the client's agent registry. Add the
in-process hook an embedder implements to answer "this actor token
belongs to agent X, valid until T" or to refuse it.

The interface carries the grant's user (sub, sub_id and the parsed
upstream subject) and the configured target, so a validator can find
the user in a directory service and decide per gateway. Refusals use
three client-facing reasons: svid_expired, approval_required and
denied. The doc comment states the contract and the rules under which
the API grows without breaking validators written today.

Nothing calls the validator yet.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Map actor validator outcomes

Turn a validator's answer into the error a client sees, so every
validator gets the same client-facing behavior whatever it returns.

A refusal with one of the three documented reasons becomes 400
invalid_request with the reason as the whole error_description. Any
other error, including a typed-nil refusal or an unknown reason, is
500 server_error: a validator cannot invent a reason or choose the
client error. An accepted result must name an agent ID of 1 to 255
printable ASCII bytes without ':'; otherwise it is server_error. A
credential whose expiry is at or before the check time, in whole
seconds, is svid_expired, because a validator may accept a credential
within its clock-skew leeway and return its past exp.

The validator's error is carried for logging as a flattened text copy,
so nothing it wrapped (for example fosite.ErrUnknownRequest, which
makes fosite skip a handler) is reachable through errors.Is.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Call actor validators with a timeout

The token endpoint must never hang on, crash on, or leak through
embedder code. Add the helper that runs... (continued)

Coverage Stats

178 of 178 new or added lines in 2 files covered. (100.0%)

74 existing lines in 7 files now uncovered.

95411 of 130440 relevant lines covered (73.15%)

889.89 hits per line