feat: RFC 8707 resource indicators for OAuth 2.0 token endpoint - #244
Open
saucam wants to merge 4 commits into
Open
feat: RFC 8707 resource indicators for OAuth 2.0 token endpoint#244saucam wants to merge 4 commits into
saucam wants to merge 4 commits into
Conversation
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
…Audience) Add AllowedResources []string and DefaultAudience string to the top-level Config struct (koanf: allowed_resources / default_audience). Wire startup validation via ValidateAllowedResources (mirrors ResolveAudienceScopeProfiles: rejects blank entries, fail closed). Extend OAuthServiceConfig and OAuthService with the two fields; wire them in NewOAuthService and server.go. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add Resource string to TokenInput.Body and TokenRequest. Resolve it once in Token() before dispatch via resolveResourceAudience (URI validation + allowlist check + DefaultAudience fallback). Store as ResolvedAudience and pass Audience: req.ResolvedAudience into all six grant handlers (client_credentials, jwt_bearer, token_exchange, api_key, authorization_code, refresh_token) and ExternalPrincipalExchange (BR-7: named audience profile wins). Wire Audience through RedeemInput for CIBA. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds tests/integration/resource_indicator_test.go covering the full RFC 8707 end-to-end path (open-mode, restricted-mode, blocked, malformed, DefaultAudience fallback, jwt_bearer grant). Adds TestIssuedTokenResourceOverridesAud to jwt_svid_aud_test.go as a regression pin for the resource→aud override on client_credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
saucam
force-pushed
the
fix/codeoid-audience-pipeline-scopes
branch
from
July 23, 2026 04:36
2fd2ef0 to
abd78fb
Compare
Contributor
Author
|
Auto-fixed by pr-shepherd (iteration 1 - branch hygiene):
Re-running CI. These are mechanical changes with no behavior impact. |
Addresses HIGH severity xDS RBAC and HTTP/2 vulnerability. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rsharath
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
resourceparameter support onPOST /oauth2/tokenper RFC 8707 §2, stamping the supplied URI asaudon the issued access tokenallowed_resourcesanddefault_audienceconfig fields; whenallowed_resourcesis non-empty, anyresourcenot in the list is rejected withinvalid_target(fail-closed)ResolvedAudiencethrough all six OAuth grant types:client_credentials,jwt_bearer, NHI token exchange, API key, authorization code, refresh token, and CIBA redeemaudienceScopeProfiles(BR-7): named audience profile wins overresourceon external-principal exchangeresource+ nodefault_audience→audremains the issuer URL (existing behavior)Test plan
go test ./internal/service/... -run TestValidateAllowedResources— 5 sub-tests passgo test ./tests/integration/... -run TestResourceIndicator— 8 sub-tests pass (open-mode, restricted-mode, blocked, malformed, fragment, no-resource fallback, DefaultAudience, jwt_bearer)go test ./tests/integration/... -run TestIssuedToken— existing + newTestIssuedTokenResourceOverridesAudpassgo build ./...cleanFixes: #199
🤖 Generated with Claude Code