fix(cte): harden act-claim extraction against decode and issuer failures

The act-claim enrichment in custom_token_exchange ran _verify_and_decode_jwt
with no error handling, so a present-but-undecodable id_token turned an
already-issued exchange into a generic TOKEN_EXCHANGE_FAILED. It also skipped
the normalized issuer check the login path applies before trusting claims.

Wrap the enrichment so any decode/verify failure leaves act=None instead of
failing the exchange, and apply the issuer check before reading the claim.
Rewrite the opaque-token test (it never exercised the decode path) and add
coverage for the undecodable-id_token and issuer-mismatch cases.

Author: kishore7snehil

src/auth0_server_python/auth_server/server_client.py

@@ -2336,13 +2336,21 @@ async def custom_token_exchange(
 
                 token_response = TokenExchangeResponse(**token_data)
 
-                # Surface the actor claim for delegation exchanges
+                # Surface the actor claim for delegation exchanges. Best-effort:
+                # a decode/verify hiccup must not fail an exchange the token
+                # endpoint already accepted, so act stays None on any failure.
                 if options.actor_token and token_response.id_token:
-                    jwks = await self._get_jwks_cached(domain, metadata)
-                    claims = await self._verify_and_decode_jwt(
-                        token_response.id_token, jwks, audience=self._client_id
-                    )
-                    token_response.act = claims.get("act")
+                    try:
+                        jwks = await self._get_jwks_cached(domain, metadata)
+                        claims = await self._verify_and_decode_jwt(
+                            token_response.id_token, jwks, audience=self._client_id
+                        )
+                        # Apply the same normalized issuer check the login path uses
+                        # before trusting any claim from the token.
+                        if self._normalize_url(claims.get("iss", "")) == self._normalize_url(metadata.get("issuer")):
+                            token_response.act = claims.get("act")
+                    except Exception:
+                        token_response.act = None
 
                 return token_response
 

src/auth0_server_python/tests/test_server_client.py

@@ -3397,11 +3397,15 @@ async def test_custom_token_exchange_surfaces_act_claim(mocker):
 
     mocker.patch.object(
         client, "_fetch_oidc_metadata",
-        return_value={"token_endpoint": "https://auth0.local/oauth/token"}
+        return_value={
+            "token_endpoint": "https://auth0.local/oauth/token",
+            "issuer": "https://auth0.local/",
+        }
     )
     mocker.patch.object(client, "_get_jwks_cached", return_value={"keys": []})
     mocker.patch.object(client, "_verify_and_decode_jwt", return_value={
         "sub": "user123",
+        "iss": "https://auth0.local/",
         "act": {"sub": "agent|abc", "act": {"sub": "svc|xyz"}},
     })
 
@@ -3433,8 +3437,8 @@ async def test_custom_token_exchange_surfaces_act_claim(mocker):
 
 
 @pytest.mark.asyncio
-async def test_custom_token_exchange_act_none_for_opaque_token(mocker):
-    """An undecodable (opaque) token leaves act as None rather than raising."""
+async def test_custom_token_exchange_act_none_when_no_id_token(mocker):
+    """A response without an id_token leaves act as None (decode path skipped)."""
     client = ServerClient(
         domain="auth0.local",
         client_id="<client_id>",
@@ -3474,6 +3478,112 @@ async def test_custom_token_exchange_act_none_for_opaque_token(mocker):
     assert result.act is None
 
 
+@pytest.mark.asyncio
+async def test_custom_token_exchange_act_none_when_id_token_undecodable(mocker):
+    """A present-but-undecodable id_token leaves act None without failing the exchange."""
+    client = ServerClient(
+        domain="auth0.local",
+        client_id="<client_id>",
+        client_secret="<client_secret>",
+        state_store=AsyncMock(),
+        transaction_store=AsyncMock(),
+        secret="some-secret"
+    )
+
+    mocker.patch.object(
+        client, "_fetch_oidc_metadata",
+        return_value={
+            "token_endpoint": "https://auth0.local/oauth/token",
+            "issuer": "https://auth0.local/",
+        }
+    )
+    mocker.patch.object(client, "_get_jwks_cached", return_value={"keys": []})
+    # No matching JWKS key -> _verify_and_decode_jwt raises; must not bubble up.
+    mocker.patch.object(
+        client, "_verify_and_decode_jwt",
+        side_effect=ValueError("No matching key found in JWKS for kid: abc")
+    )
+
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_response.json.return_value = {
+        "access_token": "delegated_token",
+        "token_type": "Bearer",
+        "expires_in": 1800,
+        "id_token": "header.payload.sig",
+    }
+    mock_response.headers.get.return_value = "application/json"
+
+    mock_httpx_client = AsyncMock()
+    mock_httpx_client.__aenter__.return_value = mock_httpx_client
+    mock_httpx_client.__aexit__.return_value = None
+    mock_httpx_client.post.return_value = mock_response
+    mocker.patch("httpx.AsyncClient", return_value=mock_httpx_client)
+
+    result = await client.custom_token_exchange(CustomTokenExchangeOptions(
+        subject_token="user-token",
+        subject_token_type="urn:ietf:params:oauth:token-type:access_token",
+        actor_token="service-token",
+        actor_token_type="urn:ietf:params:oauth:token-type:access_token",
+    ))
+
+    # Exchange still succeeds; only the act enrichment is skipped.
+    assert result.access_token == "delegated_token"
+    assert result.act is None
+
+
+@pytest.mark.asyncio
+async def test_custom_token_exchange_act_dropped_on_issuer_mismatch(mocker):
+    """An id_token from an unexpected issuer does not surface its act claim."""
+    client = ServerClient(
+        domain="auth0.local",
+        client_id="<client_id>",
+        client_secret="<client_secret>",
+        state_store=AsyncMock(),
+        transaction_store=AsyncMock(),
+        secret="some-secret"
+    )
+
+    mocker.patch.object(
+        client, "_fetch_oidc_metadata",
+        return_value={
+            "token_endpoint": "https://auth0.local/oauth/token",
+            "issuer": "https://auth0.local/",
+        }
+    )
+    mocker.patch.object(client, "_get_jwks_cached", return_value={"keys": []})
+    mocker.patch.object(client, "_verify_and_decode_jwt", return_value={
+        "sub": "user123",
+        "iss": "https://evil.example.com/",
+        "act": {"sub": "agent|abc"},
+    })
+
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_response.json.return_value = {
+        "access_token": "delegated_token",
+        "token_type": "Bearer",
+        "expires_in": 1800,
+        "id_token": "header.payload.sig",
+    }
+    mock_response.headers.get.return_value = "application/json"
+
+    mock_httpx_client = AsyncMock()
+    mock_httpx_client.__aenter__.return_value = mock_httpx_client
+    mock_httpx_client.__aexit__.return_value = None
+    mock_httpx_client.post.return_value = mock_response
+    mocker.patch("httpx.AsyncClient", return_value=mock_httpx_client)
+
+    result = await client.custom_token_exchange(CustomTokenExchangeOptions(
+        subject_token="user-token",
+        subject_token_type="urn:ietf:params:oauth:token-type:access_token",
+        actor_token="service-token",
+        actor_token_type="urn:ietf:params:oauth:token-type:access_token",
+    ))
+
+    assert result.act is None
+
+
 # =============================================================================
 # Login with Custom Token Exchange Tests
 # =============================================================================