feat(sts): answer GetCallerIdentity with multistore 0.8.0

Cargo.toml

@@ -40,10 +40,10 @@ path = "tests/keys.rs"
 
 [dependencies]
 # Multistore
-multistore = { version = "0.7.2", features = ["azure", "gcp"] }
-multistore-oidc-provider = "0.7.2"
-multistore-path-mapping = "0.7.2"
-multistore-sts = "0.7.2"
+multistore = { version = "0.8.0", features = ["azure", "gcp"] }
+multistore-oidc-provider = "0.8.0"
+multistore-path-mapping = "0.8.0"
+multistore-sts = "0.8.0"
 
 # Serialization
 serde = { version = "1", features = ["derive"] }
@@ -74,7 +74,7 @@ getrandom = { version = "0.4", features = ["wasm_js"] }
 # ring is transitive (via object_store); this direct entry only turns the
 # feature on for the wasm target.
 ring = { version = "0.17", features = ["wasm32_unknown_unknown_js"] }
-multistore-cf-workers = { version = "0.7.2", features = ["azure", "gcp"] }
+multistore-cf-workers = { version = "0.8.0", features = ["azure", "gcp"] }
 # On wasm32-unknown-unknown reqwest selects its browser `fetch` backend by
 # target arch (not a cargo feature), so the default TLS/backend features are
 # unnecessary here. The `form` feature gates `.form()`, which the STS

README.md

@@ -143,7 +143,7 @@ Any other name is refused with `MalformedPolicyDocument`, never mapped to a defa
 
 A token from a platform issuer in `PLATFORM_ISSUERS`, such as GitHub Actions, says which workload is calling but not which account it may act as. It is presented at `/.sts` from a POST form body only, as an API key is: a token in the URL is refused, because the URL is logged. It acts as the service account in `RoleArn`, `arn:aws:iam::<owner>--<name>:role/FullAccess`, and only if that account trusts the token's issuer and subject (ADR-014); an account that is not a service account is refused before anything else. The proxy verifies the token against the issuer's JWKS (looked up again for a key id it has not seen; a failure to fetch it is a retryable `InternalError`), with that issuer's own audiences and a required `exp`, then, unless a cached answer settles it and within `STS_EXCHANGE_LIMIT`, asks `POST {SOURCE_API_URL}/api/v1/accounts/{account}/trusts/exchanges` with `{"issuer", "subject"}`, as the account. Per account, issuer and subject, a yes is cached for 60 seconds and a no for 10, and the credentials' principal is the account, never the token's subject. Every refusal reads `AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity (request id …)`. A token from `AUTH_ISSUER` still acts as its own subject and ignores the account in `RoleArn`.
 
-`aws-actions/configure-aws-credentials` fails after the exchange succeeds: it checks the credentials it exports with `GetCallerIdentity`, which the proxy cannot answer until developmentseed/multistore#126 lands. Until then a workflow saves its token to a file and lets an AWS SDK exchange it, with `AWS_WEB_IDENTITY_TOKEN_FILE`, `AWS_ROLE_ARN`, `AWS_ENDPOINT_URL_STS=<proxy>/.sts`, `AWS_ENDPOINT_URL_S3=<proxy>` and `AWS_REGION`.
+`aws-actions/configure-aws-credentials` works: after the exchange it checks the credentials it exports with `GetCallerIdentity`, which the proxy answers at `/.sts` (and `/.sts/`, where its SDK sends it). The response's `Arn` and `UserId` name the Role and the account; `Account` is multistore's fixed synthetic id. A workflow can instead save its token to a file and let an AWS SDK exchange it, with `AWS_WEB_IDENTITY_TOKEN_FILE`, `AWS_ROLE_ARN`, `AWS_ENDPOINT_URL_STS=<proxy>/.sts`, `AWS_ENDPOINT_URL_S3=<proxy>` and `AWS_REGION`.
 
 ### Secrets
 

src/keys.rs

@@ -101,7 +101,7 @@ pub fn credentials_for(
         duration,
         "STSPRXY",
         &serde_json::json!({}),
-    );
+    )?;
     creds.session_token = token_key.seal(&creds)?;
     Ok(creds)
 }

src/source_api/registry.rs

@@ -243,7 +243,7 @@ async fn resolve_product(
 
     let config = BucketConfig {
         name: format!("{}{}{}", account, crate::BUCKET_SEPARATOR, product),
-        backend_type,
+        backend_type: backend_type.parse()?,
         backend_prefix,
         // Proxy-client-facing: Source Cooperative authorizes callers via its own
         // JWT (enforced upstream at the subject-scoped fetch), not S3 request

src/sts.rs

@@ -78,7 +78,11 @@ pub(crate) fn role(
         name: name.to_string(),
         trusted_oidc_issuers: vec![oidc_issuer],
         required_audiences,
-        subject_conditions: vec![],
+        // Any subject: the person issuer's token names the person, and a
+        // platform token acts only as an account that trusts its subject.
+        subject_conditions: vec!["*".to_string()],
+        // Every issuer must set `exp`; a token without one is replayable for good.
+        allow_missing_exp_from: vec![],
         allowed_scopes,
         max_session_duration_secs,
     })