Test OAuth agent delegation without trusting the wrong actor
A token can be valid while the policy consuming it is wrong. One particularly useful regression test for agent delegation is an unapproved current actor with an approved actor buried in its history. If the API walks the chain until it finds an allowed name, the test should expose that mistake. This walkthrough uses a fictional invoice-fetching workflow. It includes a small tested policy fixture,…
The article discusses a test for OAuth agent delegation involving an unapproved current actor with an approved actor in its history. The goal is to expose mistakes where the API walks the chain until it finds an allowed name. The walkthrough uses a fictional invoice-fetching workflow with a tested policy fixture, separate from an OAuth server, JWT validator, or production authorization library.
The exchange request includes subject_token and subject_token_type, while actor_token is optional. The server validates subject and actor credentials and checks permitted relationships before issuing a downstream token. The API should consume the profile the issuer actually supports, without assuming every provider emits an act claim or that an access token must be a JWT.
The fixture assumes checks already succeeded, including a trusted grant lookup and tenant resolution. The function tests the specific resource-side authorization rule, ensuring that passing the audience check does not pass the scope check, and passing both does not authorize another tenant's invoice.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
