upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-05-28 04:10:44 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

VAULT-42859: surface authorization_details from inbound JWT into logical.Auth (#12750) (#12919)

Browse source 
Co-authored-by: Bianca <48203644+biazmoreira@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Vault Automation 2026-03-12 03:48:34 -04:00 committed by GitHub
parent faba3e06a3
commit 1b30f42e06
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 43 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
sdk/logical/auth.go
View file

@ -124,6 +124,13 @@ type Auth struct {
// HTTPRequestPriority contains potential information about the request
// priority based on required path capabilities
HTTPRequestPriority *uint8 `json:"http_request_priority"`
// AuthorizationDetails holds fine-grained authorization constraints for the request.
// Each element is a JSON object with at minimum a "type" field.
// It is nil when the token does not carry authorization details.
// It is not included in plugin RPC serialization because it is only needed at request-routing
// time and not during plugin Renew or Revoke operations.
AuthorizationDetails []AuthorizationDetail `json:"authorization_details,omitempty"`
}
func (a *Auth) GoString() string {

2
vault/request_handling.go
View file

@ -587,6 +587,8 @@ func (c *Core) CheckToken(ctx context.Context, req *logical.Request, unauth bool
auth.ActorEntityID = req.Auth.ActorEntityID
auth.ActorEntityName = req.Auth.ActorEntityName
}
// Copy authorization details from the request to auth so plugins can access them.
auth.AuthorizationDetails = req.EnterpriseTokenAuthorizationDetails
twoStepRecover := req.Operation == logical.RecoverOperation && req.RecoverSourcePath != "" && req.RecoverSourcePath != req.Path
var alternateRecoverCapability *logical.Operation

34
vault/request_handling_test.go
View file

@ -641,3 +641,37 @@ func TestRequestHandling_fetchACLTokenEntryAndEntity_NilRequest(t *testing.T) {
require.Error(t, err)
require.Equal(t, ErrInternalError, err)
}
// TestAuth_AuthorizationDetails_CopiedFromRequest verifies that logical.Auth.AuthorizationDetails
// matches the authorization details already carried on the request.
func TestAuth_AuthorizationDetails_CopiedFromRequest(t *testing.T) {
t.Parallel()
details := []logical.AuthorizationDetail{
{"type": "account_information", "scope": "read"},
{"type": "payment_initiation", "amount": "100"},
}
auth := &logical.Auth{}
req := &logical.Request{
EnterpriseTokenAuthorizationDetails: details,
}
// Simulate the assignment performed in CheckToken.
auth.AuthorizationDetails = req.EnterpriseTokenAuthorizationDetails
require.Equal(t, details, auth.AuthorizationDetails, "auth.AuthorizationDetails must equal req.EnterpriseTokenAuthorizationDetails")
}
// TestAuth_AuthorizationDetails_NilWhenAbsent verifies that auth.AuthorizationDetails is nil
// when the request does not carry authorization details.
func TestAuth_AuthorizationDetails_NilWhenAbsent(t *testing.T) {
t.Parallel()
auth := &logical.Auth{}
req := &logical.Request{}
auth.AuthorizationDetails = req.EnterpriseTokenAuthorizationDetails
require.Nil(t, auth.AuthorizationDetails)
}