stacklok / toolhive / 43249648476

73%

Build Type

push

github

Committed by web-flow

Commit Message

Configure actor-token validators for delegate clients (#7123)

* Register actor-token validators in Config

An embedder that holds an agent registry needs a way to hand its
actor-token validator to the authorization server. Add
Config.ActorTokenValidators, a map from name to a registration set in
process, with no YAML or JSON form and no global registry. A client
will select one by name in its actor profile.

A registration pairs the validator with ActIssuer, the issuer ToolHive
writes as act.iss for the agents that validator accepts. The validator
never sets it, so one validator cannot claim to speak for another
issuer's agents. ActIssuer is emitted as configured and registrations
may share one.

Config.Validate refuses an empty name, a name in the "toolhive."
namespace, which is reserved for built-in validators, and a nil
validator, including a nil pointer of a concrete type. It also refuses
an ActIssuer that is empty, is not an absolute URI without query,
userinfo or fragment, is not in canonical spelling, is an http(s) URL
with no host or one that is neither https nor on a loopback host, or is
this server's own issuer. Names are checked in sorted order so the
reported error is stable. The nil check reuses the refresh-grant
handler check, generalized to isNilValue and moved to nil_value.go.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Add actor_profile to delegate clients

A delegate client that obtains ID-JAGs from exchange grants on behalf
of agents needs the issuing server to check which agent is acting.
Add token_exchange.actor_profile, which names the in-process validator
for that check and the actor_token_type the client must send.

The field is set only from Go, by embedders, like RequiredSubjectClaims,
and has no JSON or YAML form. Config files cannot set it, and it stays
out of the RunConfig API schema, until ID-JAG issuance checks it.

Startup refuses a profile on a client without an id_jag block, a
missing validator name, and a missin... (continued)

Coverage Stats

166 of 168 new or added lines in 6 files covered. (98.81%)

21 existing lines in 5 files now uncovered.

95572 of 130594 relevant lines covered (73.18%)

889.36 hits per line