stacklok / toolhive
70%

DEFAULT BRANCH: main
Repo Added
Files 912
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 70.087% (+0.2%) from 69.929%
33973344999

push

github

web-flow 
Normalize canonical inbound grants (#6473)

* Normalize canonical inbound grants

The SPIFFE client-auth epic needs a place to configure SPIFFE
association policy without inventing a parallel trust/grant path next
to the existing delegate-client and trusted-issuer configuration. As
more inbound grant families (RFC 8693 token exchange, RFC 7523
JWT-bearer, SPIFFE) accumulate, they need one canonical surface to
configure and reason about instead of three independent ones, without
breaking deployments that already rely on the legacy fields.

Add pkg/authserver/inbound_grants.go with NormalizeInboundGrants, which
reconciles a new canonical RunConfig.InboundGrants surface (per-family
token_exchange/jwt_bearer sub-configs whose issuer_policies reference a
trusted_issuers entry by name) against the legacy top-level
delegate_clients and the RFC 8693/7523 fields embedded directly on
trusted_issuers. Legacy and canonical configuration for the same grant
family are mutually exclusive and rejected at validation time; the two
families are otherwise independent, and omitting inbound_grants
entirely preserves released behavior. Thread the normalized result
through RunConfig.Validate, the embedded-auth-server runner, and
buildProvider/discovery, adding a DisableTokenExchange capability so
RFC 8693 registration and discovery advertisement can be turned off
together and can't drift out of sync. Add TrustedIssuer.Name so
canonical issuer_policies can reference an issuer without duplicating
its fields.

SPIFFE client authentication (InboundGrants.SPIFFEClientAuth, defined
in the previous commit) is deliberately kept a sibling of TokenExchange
and JWTBearer here, not nested under either: SPIFFE authenticates a
client, it does not by itself grant it anything, so making it subordinate
to RFC 8693 enablement would mean disabling token exchange silently drops
every SPIFFE association, and every SPIFFE-authenticated client would be
implicitly token-exchange-capable. It is vali... (continued)

713 of 861 new or added lines in 23 files covered. (82.81%)

8 existing lines in 4 files now uncovered.

78465 of 111954 relevant lines covered (70.09%)

93.24 hits per line

Relevant lines Covered
111954 RELEVANT LINES 78465 COVERED LINES
93.24 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
33973344999 main Normalize canonical inbound grants (#6473) * Normalize canonical inbound grants The SPIFFE client-auth epic needs a place to configure SPIFFE association policy without inventing a parallel trust/grant path next to the existing delegate-client a... push web-flow github
70.09
33970074849 spiffe-integration-split3-7 Merge 4093b332d into e44e5c897 Pull #6501 web-flow github
69.99
33969952670 spiffe-integration-split3-6 Merge e44e5c897 into d6345681a Pull #6500 web-flow github
70.0
33969832441 spiffe-integration-split3-5 Merge d6345681a into d2d311d30 Pull #6499 web-flow github
70.0
33969689253 spiffe-integration-split3-3 Merge d2d311d30 into e30f1bf37 Pull #6473 web-flow github
70.05
33926779750 renovate/anthropics-claude-code-action-1.x Merge e7a797819 into e30f1bf37 Pull #6462 web-flow github
69.94
33916344336 feat/ratelimit-tool-attribution Merge cbb708f99 into e30f1bf37 Pull #6517 web-flow github
70.0
33913807656 fix/6507-claude-desktop-windows-helper Merge e349867e8 into e30f1bf37 Pull #6516 web-flow github
69.92
33907585027 main Allow Cedar delegation without an upstream session (#6506) * Allow Cedar delegation without an upstream session RFC 8693 delegated tokens and RFC 7523 JWT-bearer tokens link to no upstream IdP login, so a configured primary provider rejected the... push web-flow github
69.93
33903773684 prompt-cache Merge 4b47ee5dd into b5d52b6a9 Pull #6515 web-flow github
70.0
See All Builds (12663)