hyperscale-stack / security

92%

master: 92%

LAST BUILD ON BRANCH feature/63-oauth2-error-hook

branch: feature/63-oauth2-error-hook

CHANGE BRANCH

x

Reset

Sync Branches

• feature/63-oauth2-error-hook
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7
• dependabot/github_actions/actions/setup-go-7
• dependabot/github_actions/softprops/action-gh-release-3
• dependabot/go_modules/connectrpc.com/grpchealth-1.5.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.19.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.20.1
• dependabot/go_modules/github.com/redis/go-redis/v9-9.21.0
• dependabot/go_modules/github.com/redis/go-redis/v9-9.22.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.0
• dependabot/go_modules/github.com/rs/zerolog-1.35.1
• dependabot/go_modules/github.com/stretchr/testify-1.12.1
• dependabot/go_modules/go.opentelemetry.io/otel-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.44.0
• dependabot/go_modules/go.opentelemetry.io/otel/trace-1.45.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/golang.org/x/crypto-0.46.0
• dependabot/go_modules/golang.org/x/crypto-0.47.0
• dependabot/go_modules/golang.org/x/crypto-0.48.0
• dependabot/go_modules/golang.org/x/crypto-0.49.0
• dependabot/go_modules/golang.org/x/crypto-0.50.0
• dependabot/go_modules/golang.org/x/crypto-0.51.0
• dependabot/go_modules/golang.org/x/crypto-0.52.0
• dependabot/go_modules/golang.org/x/crypto-0.53.0
• dependabot/go_modules/golang.org/x/crypto-0.54.0
• dependabot/go_modules/golang.org/x/crypto-0.55.0
• dependabot/go_modules/google.golang.org/grpc-1.81.1
• dependabot/go_modules/google.golang.org/grpc-1.82.0
• dependabot/go_modules/google.golang.org/grpc-1.82.1
• dependabot/go_modules/google.golang.org/grpc-1.83.0
• dependabot/go_modules/google.golang.org/grpc-1.83.1
• dependabot/go_modules/modernc.org/sqlite-1.51.0
• dependabot/go_modules/modernc.org/sqlite-1.52.0
• dependabot/go_modules/modernc.org/sqlite-1.53.0
• dependabot/go_modules/modernc.org/sqlite-1.54.0
• dependabot/go_modules/modernc.org/sqlite-1.56.0
• dependabot/go_modules/modernc.org/sqlite-1.57.0
• feature/64-oauth2-expires-in-clock
• feature/connectrpc
• feature/oauth2-server
• feature/refactoring
• master

Build # 32661203771

Build Type

Pull #65

github

Committed by euskadi31

Commit Message

feat(oauth2): add an error hook so server_error causes are observable

An RFC 6749 §5.2 response carries a code, a description and a URI — never
the cause. A server_error therefore reached the client as an opaque 500 and
was dropped everywhere else, leaving an operator with nothing to diagnose.
RFC 7009 §2.2 made it worse on /revoke: a failed revocation still answers
200 OK, so the failure was unobservable too.

ServerConfig.OnError (type ErrorHook) is called with the normalized *Error
envelope — cause intact — at the point the server decides on its answer:
every RFC 6749 §5.2 body, every /authorize redirect, the pre-redirect
refusals answered with a bare 400, and the best-effort revocations /revoke
swallows. grant.Config.OnError does the same for the family revocation a
grant swallows during BCP §8.10.3 reuse detection.

The hook is purely observational — no response, status code or redirect
changes. Refs #63.

Pull Request Pull Request #65: feat(oauth2): add an error hook so server_error causes are observable

Coverage Stats

57 of 70 new or added lines in 8 files covered. (81.43%)

3906 of 4257 relevant lines covered (91.75%)

12.54 hits per line