Accept both PDP token audiences while preserving caller bindings

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

internal/callerauth/auth.go

@@ -130,7 +130,14 @@ func (a *Authenticator) Record(identity Identity) Record {
 		return record
 	}
 	record.Principal = identity.Username
-	record.Audience = audience
+	// Stamp an audience actually returned by TokenReview, never merely the
+	// configured audience. Prefer the configured spelling when both matched.
+	for _, accepted := range runtimeAudiences(audience) {
+		if contains(identity.Audiences, accepted) {
+			record.Audience = accepted
+			break
+		}
+	}
 	record.NotAfter = identity.NotAfter
 	return record
 }
@@ -153,7 +160,7 @@ func (a *Authenticator) authorize(ctx context.Context, authorization string, sys
 			identity.NotAfter = exp
 		}
 	}
-	if strings.TrimSpace(identity.Username) == "" || !contains(identity.Audiences, a.audience) {
+	if strings.TrimSpace(identity.Username) == "" || !matchesRuntimeAudience(identity.Audiences, a.audience) {
 		return Identity{}, ErrUnauthenticated
 	}
 	if len(systems) == 0 {
@@ -176,3 +183,26 @@ func contains(values []string, wanted string) bool {
 	}
 	return false
 }
+
+// runtimeAudiences is the bounded FLEX-WP-0036 compatibility window. It
+// changes only the PDP audience, never protected-system names or principals.
+// A custom configured audience retains its exact original meaning.
+func runtimeAudiences(configured string) []string {
+	switch configured {
+	case "flex-auth":
+		return []string{"flex-auth", "access-engine"}
+	case "access-engine":
+		return []string{"access-engine", "flex-auth"}
+	default:
+		return []string{configured}
+	}
+}
+
+func matchesRuntimeAudience(reviewed []string, configured string) bool {
+	for _, accepted := range runtimeAudiences(configured) {
+		if contains(reviewed, accepted) {
+			return true
+		}
+	}
+	return false
+}

internal/callerauth/runtime_rename_test.go

@@ -0,0 +1,147 @@
+package callerauth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestRuntimeRenameEveryInstalledPinBinding(t *testing.T) {
+	pins := []string{"ops-warden", "ops-warden-fetch", "secrets-engine", "user-engine", "tenant-engine", "informed-decision-lifecycle", "informed-decision-sitting", "informed-decision-t03", "application-readback"}
+	for _, pin := range pins {
+		t.Run(pin, func(t *testing.T) {
+			data, err := os.ReadFile(filepath.Join("..", "..", "values", pin+".yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var value struct {
+				CallerAuth struct {
+					Binding string   `yaml:"binding"`
+					Extra   []string `yaml:"extraBindings"`
+				} `yaml:"callerAuth"`
+				Readback struct {
+					Caller string `yaml:"caller"`
+				} `yaml:"readback"`
+			}
+			if err := yaml.Unmarshal(data, &value); err != nil {
+				t.Fatal(err)
+			}
+			bindings := map[string]string{}
+			for _, entry := range append([]string{value.CallerAuth.Binding}, value.CallerAuth.Extra...) {
+				if entry == "" {
+					continue
+				}
+				system, principal, ok := strings.Cut(entry, "=")
+				if !ok {
+					t.Fatalf("bad binding: %s", entry)
+				}
+				bindings[system] = principal
+			}
+			// Readback's bounded authenticated caller is installed by serve-readback,
+			// rather than a callerAuth binding flag.
+			if value.Readback.Caller != "" {
+				bindings["application-readback"] = value.Readback.Caller
+			}
+			if len(bindings) == 0 {
+				t.Fatal("pin has no installed caller mapping")
+			}
+			for system, principal := range bindings {
+				for _, configured := range []string{"flex-auth", "access-engine"} {
+					for _, reviewed := range []string{"flex-auth", "access-engine"} {
+						a, err := New(ModeEnforce, fakeReviewer{identity: Identity{Username: principal, Audiences: []string{reviewed}}}, configured, bindings, nil)
+						if err != nil {
+							t.Fatal(err)
+						}
+						id, err := a.Authorize(context.Background(), "Bearer test-token", []string{system})
+						if err != nil {
+							t.Fatal(err)
+						}
+						if got := a.Record(id).Audience; got != reviewed {
+							t.Fatalf("provenance %q != reviewed %q", got, reviewed)
+						}
+						for _, forbidden := range []string{"foreign-consumer", "flex-auth", "access-engine"} {
+							if _, err := a.Authorize(context.Background(), "Bearer test-token", []string{forbidden}); !errors.Is(err, ErrForbidden) {
+								t.Fatalf("%s accepted as %s: %v", system, forbidden, err)
+							}
+						}
+						wrong, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "other-principal", Audiences: []string{reviewed}}}, configured, bindings, nil)
+						if _, err := wrong.Authorize(context.Background(), "Bearer test-token", []string{system}); !errors.Is(err, ErrForbidden) {
+							t.Fatalf("wrong principal: %v", err)
+						}
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestRuntimeRenameUsesActualTokenReviewAudience(t *testing.T) {
+	for _, configured := range []string{"flex-auth", "access-engine", "custom-pdp"} {
+		for _, returned := range []string{"flex-auth", "access-engine", "foreign", "custom-pdp", ""} {
+			t.Run(configured+"/"+returned, func(t *testing.T) {
+				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+					var request tokenReview
+					if err := json.NewDecoder(req.Body).Decode(&request); err != nil {
+						t.Error(err)
+						return
+					}
+					if !reflect.DeepEqual(request.Spec.Audiences, runtimeAudiences(configured)) {
+						t.Errorf("requested audiences: %v", request.Spec.Audiences)
+					}
+					response := tokenReview{}
+					response.Status.Authenticated = true
+					response.Status.User.Username = "principal"
+					if returned != "" {
+						response.Status.Audiences = []string{returned}
+					}
+					_ = json.NewEncoder(w).Encode(response)
+				}))
+				defer srv.Close()
+				file := filepath.Join(t.TempDir(), "reviewer")
+				if err := os.WriteFile(file, []byte("test-only-reviewer"), 0600); err != nil {
+					t.Fatal(err)
+				}
+				reviewer := &KubernetesTokenReviewer{endpoint: srv.URL, audience: configured, reviewerTokenFile: file, client: srv.Client()}
+				a, _ := New(ModeEnforce, reviewer, configured, map[string]string{"consumer": "principal"}, nil)
+				// The untrusted token claims the opposite: only authenticated TokenReview
+				// response audiences decide admission and provenance.
+				token := unsignedJWT(map[string]any{"aud": "foreign", "sub": "forged"})
+				id, err := a.Authorize(context.Background(), "Bearer "+token, []string{"consumer"})
+				want := contains(runtimeAudiences(configured), returned)
+				if want {
+					if err != nil {
+						t.Fatal(err)
+					}
+					if a.Record(id).Audience != returned {
+						t.Fatal("configured/untrusted audience leaked into provenance")
+					}
+				} else if !errors.Is(err, ErrUnauthenticated) {
+					t.Fatalf("foreign/missing audience accepted: %v", err)
+				}
+			})
+		}
+	}
+}
+
+func TestRuntimeRenameCustomAudienceAndInputBindingsStayExact(t *testing.T) {
+	bindings := map[string]string{"flex-auth": "principal"}
+	a, err := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"custom-pdp"}}}, "custom-pdp", bindings, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.Authorize(context.Background(), "Bearer test", []string{"access-engine"}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("uninstalled alias binding accepted: %v", err)
+	}
+	if len(bindings) != 1 {
+		t.Fatal("input bindings mutated")
+	}
+}

internal/callerauth/tokenreview.go

@@ -76,7 +76,7 @@ func (r *KubernetesTokenReviewer) Review(ctx context.Context, callerToken string
 		Kind:       "TokenReview",
 		Spec: tokenReviewSpec{
 			Token:     callerToken,
-			Audiences: []string{r.audience},
+			Audiences: runtimeAudiences(r.audience),
 		},
 	})
 	if err != nil {