fix(breg): admit the RFC 9068 typ pair as one token type - #983
Conversation
The verifier profile pinned exactly one typ string, so an issuer emitting the other RFC 9068 spelling of the same access-token media type was refused until an operator edited accessTokenType - a config tripwire, not a semantic choice. RFC 9068 section 4 requires resource servers to accept both at+jwt and application/at+jwt and reject every other value. registry-platform-oidc gains access_token_typ_set(), which expands a configured type to its admitted spellings, and is_access_token_typ_pair(), which recognises the one two-element allowed_typ shape that still names a single token type. BREG builds its profile through the expansion and validates the pair shape instead of requiring exactly one element, so JWT next to at+jwt is still refused while either spelling of the media type is accepted under one configuration. Relay, Mint and Evidence profiles are unchanged. Closes #981. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 813489bef7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /// The one admitted access-token `typ` semantics. Configuring the | ||
| /// RFC 9068 access-token media type as `at+jwt` or | ||
| /// `application/at+jwt` admits both spellings of that one type; any | ||
| /// other value (for example `JWT`) admits only that exact value. |
There was a problem hiding this comment.
With the schema feature enabled, schemars copies this new field documentation into the generated accessTokenType.description, but products/breg/generated/runtime/runtime.schema.json still has no such description. Consequently, committed_runtime_schema_matches_generated_bytes and products/breg/scripts/check-generated.sh will deterministically fail; regenerate and commit the runtime schema with this change.
AGENTS.md reference: AGENTS.md:L384-L387
Useful? React with 👍 / 👎.
1 participant
What
The access-token verifier profile pinned exactly one
typheader value. RFC 9068 lets an issuer emit eitherat+jwtorapplication/at+jwtfor the same access-token media type and requires resource servers to accept both (RFC 9068 §4), so an operator pinned to one string rejected a compliant issuer that used the other spelling — the difference surfaced only as a generic token refusal after switching providers.registry-platform-oidcgains two public helpers:access_token_typ_set(configured)— theallowed_typlist a single configured type admits: the pair for either spelling of the access-token media type, the value itself for anything else.is_access_token_typ_pair(values)— recognises the one two-element shape that still names a single token type.BREG builds its verifier profile through the expansion (
OidcVerifierConfig::token_verifier_config) and its profile validation (admits_one_access_token_type) accepts a single valid value or exactly the RFC 9068 pair, refusing every other shape. Relay, Mint and Evidence profiles are unchanged.Verification
cargo test --locked -p registry-platform-oidc— 52 passed, including two new unit tests for the expansion and the pair predicate (order, casing, single, duplicate, triple, mixed shapes).cargo test --locked -p registry-breg --features runtime --test http_auth— 25 passed. New: a token withtyp: at+jwtand the same token withtyp: application/at+jwtare both accepted under one configuration (for either configured spelling), whiletyp: JWTunder that configuration and the platformTokenTypeNotAllowedrefusal are asserted. Extended: the constructor now also refuses a blank single value and the pair plus an extra value, next to the existing two-semantics refusal.cargo test --locked -p registry-breg --features runtime,tooling --test startup_http— 8 passed;issuer_portabilityunchanged (1 pre-existing ignore).cargo clippy --locked -p registry-platform-oidc -p registry-breg --all-targets ...clean under default,runtime,runtime,toolingandschemafeature sets;cargo fmt --checkclean.Docs
docs/operate/breg: the token-verification table now states that either RFC 9068 spelling is accepted whenaccessTokenTypenames the access-token media type.Closes #981.