Admin/template-studio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: preserve consumer audience auth semantics

Browse Source
This commit is contained in:
Admin 2026-09-24 18:37:58 +00:00
parent 303c325d39
commit b108136bab
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
server/auth.js
View File

@ -96,7 +96,7 @@ function ensureConfigured() {
if (!issuer || !clientId || !clientSecret) throw new Error('Keycloak OIDC is not fully configured') if (!issuer || !clientId || !clientSecret) throw new Error('Keycloak OIDC is not fully configured')
} }
async function verifyAllowedMachineToken(token, allowedClients, purpose) { async function verifyAllowedMachineToken(token, allowedClients, purpose, { exactClient = false } = {}) {
const { issuer } = config() const { issuer } = config()
if (!issuer) throw new Error('KEYCLOAK_ISSUER is required') if (!issuer) throw new Error('KEYCLOAK_ISSUER is required')
if (!allowedClients.length) throw new Error(`No ${purpose} clients are allowed`) if (!allowedClients.length) throw new Error(`No ${purpose} clients are allowed`)
@ -105,10 +105,12 @@ async function verifyAllowedMachineToken(token, allowedClients, purpose) {
const { payload } = await jwtVerify(token, jwks, { issuer }) const { payload } = await jwtVerify(token, jwks, { issuer })
const client = String(payload.azp || '') const client = String(payload.azp || '')
if (!client || !allowedClients.includes(client)) { const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud].filter(Boolean)
throw new Error(`Token client is not allowed for ${purpose}`) const allowed = exactClient
} ? Boolean(client && allowedClients.includes(client))
: allowedClients.some(value => value === client || audiences.includes(value))
if (!allowed) throw new Error(`Token client is not allowed for ${purpose}`)
return payload return payload
} }
@ -119,7 +121,7 @@ export async function verifyMachineToken(token) {
export async function verifyMcpToken(token) { export async function verifyMcpToken(token) {
const { allowedMcpClients } = config() const { allowedMcpClients } = config()
return verifyAllowedMachineToken(token, allowedMcpClients, 'template authoring') return verifyAllowedMachineToken(token, allowedMcpClients, 'template authoring', { exactClient: true })
} }
export function registerAuthRoutes(app) { export function registerAuthRoutes(app) {