lux/aml
2
0
Fork 0
mirror of https://github.com/luxfi/aml.git synced 2026-09-24 00:25:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

iam: an unpinned deployment must also cost nothing to ask

Browse Source 
Mutation-testing the audience guard found it unheld: removing the "no audience
configured" refusal changed no test, because golang-jwt happens to refuse
everything when the expected audience is the empty string (expectedAud becomes
[""], which no token's aud contains). The guard was right and the test was
weak — and it was resting on library behaviour nobody had written down, so a
future release that read an empty expectation as "no check" would have turned
every unpinned deployment into one that accepts any token, silently.

The property is now stated where it is independent of the library: an instance
with no audience configured refuses BEFORE resolving a keyset, so it costs no
issuer round trip per request either. Breaking the guard now fails the test.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-07-29 22:37:10 -07:00
co-authored by Hanzo Dev
parent f7df6eb71e
commit 3509e29cd7
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/iam_test.go
+14 -2
View File
@@ -343,11 +343,23 @@ func TestAudienceIsThisApplication(t *testing.T) {
// With no audience configured nothing authenticates, including a token that is
// otherwise perfect. An unpinned deployment would accept every token its issuer
// ever minted, so it accepts none.
// ever minted, so it accepts none — and it says so without asking the issuer for
// keys, because a deployment that cannot identify anybody must not spend a
// network round trip per request finding that out. Refusing at the top is what
// makes this independent of how the JWT library happens to treat an empty
// expected audience.
for _, unpinned := range []string{"", " "} {
if tenant, err := IAMIdentity(published, unpinned)(bearing("api.hanzo.ai", rs256(t, base()))); err == nil {
var asked atomic.Int64
counted := func(issuer string) (Keyset, error) {
asked.Add(1)
return published(issuer)
}
if tenant, err := IAMIdentity(counted, unpinned)(bearing("api.hanzo.ai", rs256(t, base()))); err == nil {
t.Errorf("with audience %q configured, a token authenticated as %q", unpinned, tenant)
}
if n := asked.Load(); n != 0 {
t.Errorf("with audience %q configured, a request cost %d issuer fetches, want 0", unpinned, n)
}
}
}