fix(auth): require audience when introspecting via Google tokeninfo

[SashaMIT]

Problem

The Google tokeninfo path has a validation hole:

1. Google's tokeninfo endpoint returns no iss claim. GoogleProvider.parseGoogleResponse (token.go) compensates by setting claims["iss"] = "https://accounts.google.com" locally.
2. validateClaims then compares that fabricated value against the configured issuer — a check that is self-satisfying: it passes for every token tokeninfo accepts and proves nothing about which OAuth client the token was minted for.
3. The only remaining binding to the deployment is the audience check, and it is conditional: if v.audience != "". Audience is optional everywhere — NewTokenValidator doesn't require it, --oidc-audience defaults to empty, the operator CRD marks it Optional.

Net effect: a deployment configured with issuer https://accounts.google.com + introspection URL https://oauth2.googleapis.com/tokeninfo + no audience accepts any valid Google OAuth access token — including one minted for an unrelated attacker-registered OAuth client. That token passes ValidateToken, becomes an auth.Identity, and lands in the request context.

Fix

NewTokenValidator refuses IntrospectionURL == GoogleTokeninfoURL with an empty audience at startup, with an error explaining why. Fail-closed beats a silently-accepting runtime.

Tests

New TestNewTokenValidator_GoogleTokeninfoRequiresAudience: tokeninfo-without-audience is rejected with the explanatory error; the same config with an audience is accepted. Full pkg/auth suite passes.

Made with Cursor

Made with Cursor

[jhrozek]

Nice fix, this closes a real gap — tokeninfo doesn't give you a verifiable iss so audience was the only thing actually binding the token to this deployment. Two small optional nits below, neither blocking.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.87%. Comparing base (04198d4) to head (dfa64a8).
⚠️ Report is 47 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6236      +/-   ##
==========================================
+ Coverage   72.54%   72.87%   +0.32%     
==========================================
  Files         739      742       +3     
  Lines       76851    77786     +935     
==========================================
+ Hits        55755    56688     +933     
+ Misses      17113    17107       -6     
- Partials     3983     3991       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[SashaMIT]

Thanks for landing the nits yourself. Trim on audience and the table-driven test are the right shape, and pulling the Google tokeninfo check out of NewTokenValidator is cleaner than fighting gocyclo.

Happy to leave the rest with you.

[jhrozek]

Both nits addressed (helper extraction fixes the gocyclo lint failure too). CI green aside from the pre-existing, unrelated GitHub Actions Static Analysis failure that's also failing on main.