fix(auth): require audience when introspecting via Google tokeninfo

pkg/auth/token.go

@@ -588,7 +588,7 @@
 }
 
 // NewTokenValidator creates a new token validator.
 func NewTokenValidator(ctx context.Context, config TokenValidatorConfig, opts ...TokenValidatorOption) (*TokenValidator, error) {
 	// Apply functional options
 	o := &tokenValidatorOptions{envReader: &env.OSReader{}}
 	for _, opt := range opts {
@@ -640,6 +640,19 @@
 		return nil, ErrMissingIssuerAndJWKSURL
 	}
 
+	// Google's tokeninfo endpoint returns no iss claim - parseGoogleResponse
+	// synthesises iss locally, so a configured-issuer check against it is
+	// self-satisfying and proves nothing about which OAuth client the token
+	// was minted for. The only real binding to this deployment is the
+	// audience check, which is skipped when audience is empty. Without it,
+	// ANY valid Google access token (e.g. one minted for an attacker's own
+	// unrelated OAuth client) passes validation. Refuse the combination at
+	// startup instead of silently accepting cross-client tokens at runtime.
+	if config.IntrospectionURL == GoogleTokeninfoURL && config.Audience == "" {
+		return nil, fmt.Errorf("audience is required when using Google's tokeninfo endpoint for introspection: " +
+			"without it any valid Google access token is accepted regardless of the OAuth client it was minted for")
+	}
+
 	// Create HTTP client with CA bundle and auth token support for JWKS
 	httpClient, err := networking.NewHttpClientBuilder().
 		WithCABundle(config.CACertPath).

pkg/auth/token_test.go

@@ -3075,3 +3075,30 @@ func TestEnsureJWKSRegistered_NonFatalRegistrationErrors(t *testing.T) {
 		require.True(t, validator.jwksRegistered)
 	})
 }
+
+func TestNewTokenValidator_GoogleTokeninfoRequiresAudience(t *testing.T) {
+	t.Setenv("TOOLHIVE_SKIP_OIDC_DISCOVERY", "true")
+
+	// Google tokeninfo + no audience must be rejected at startup: tokeninfo
+	// returns no iss claim (the provider synthesises it locally), so an
+	// issuer check is self-satisfying and the audience check is the only
+	// binding to this deployment. Without it, any valid Google access token
+	// passes regardless of which OAuth client minted it.
+	_, err := NewTokenValidator(context.Background(), TokenValidatorConfig{
+		Issuer:           "https://accounts.google.com",
+		JWKSURL:          "https://www.googleapis.com/oauth2/v3/certs",
+		IntrospectionURL: GoogleTokeninfoURL,
+		Audience:         "",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "audience is required")
+
+	// With an audience configured, the same setup must be accepted.
+	_, err = NewTokenValidator(context.Background(), TokenValidatorConfig{
+		Issuer:           "https://accounts.google.com",
+		JWKSURL:          "https://www.googleapis.com/oauth2/v3/certs",
+		IntrospectionURL: GoogleTokeninfoURL,
+		Audience:         "my-client-id.apps.googleusercontent.com",
+	})
+	require.NoError(t, err)
+}