Exchange Flow to hstern/go-token-exchange (mechanical swap) #35

New issue

Closed

opened 2026-09-15 23:27:08 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:27:08 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

The Exchange Flow's RFC 8693 code runs on github.com/hstern/go-token-exchange — client_id sent via the library's Extra, actor fields omitted, no client secret. Behavior is preserved: the per-replica token cache, the exchanged-token Authorization injection, and the subject-token consumption are unchanged.

Acceptance criteria

The RFC 8693 exchange uses hstern/go-token-exchange.
The request sends client_id (via Extra), omits the actor fields, and sends no client secret.
The per-replica token cache, Authorization injection, and subject-token removal are unchanged.
The exchange serve tests pass (adapted to hstern).
make lint and make test pass.

Blocked by

None — can start immediately.

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build The **Exchange Flow**'s RFC 8693 code runs on `github.com/hstern/go-token-exchange` — `client_id` sent via the library's `Extra`, actor fields omitted, no client secret. Behavior is preserved: the per-replica token cache, the exchanged-token `Authorization` injection, and the subject-token consumption are unchanged. ## Acceptance criteria - [ ] The RFC 8693 exchange uses `hstern/go-token-exchange`. - [ ] The request sends `client_id` (via `Extra`), omits the actor fields, and sends no client secret. - [ ] The per-replica token cache, `Authorization` injection, and subject-token removal are unchanged. - [ ] The exchange serve tests pass (adapted to hstern). - [ ] `make lint` and `make test` pass. ## Blocked by - None — can start immediately.

ginjiruu referenced this issue

2026-09-15 23:27:28 +00:00

E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:35 +00:00

ginjiruu referenced this issue from a commit

2026-09-16 00:37:34 +00:00

refactor: Exchange Flow uses hstern/go-token-exchange (#35)

ginjiruu referenced this issue from a pull request that will close it,

2026-09-16 00:38:45 +00:00