feat: OIDC-to-Policy bridge and Trust Registry

[bordumb]

Summary

• OIDC-to-Policy Bridge (oidc-policy feature): Adds OidcClaims → EvalContext adapter and wires policy evaluation into the token exchange flow. Policy denials return 403 with POLICY_DENIED code.
• OIDC Trust Registry (oidc-trust feature): Adds TrustRegistry types with provider lookup, repo glob matching, capability intersection, and TTL capping. Trust checks run before policy evaluation and return specific 403 codes (PROVIDER_NOT_TRUSTED, REPOSITORY_NOT_ALLOWED, CAPABILITY_NOT_ALLOWED).
• Both features are independent, optional, and feature-gated behind oidc-policy and oidc-trust respectively.

Test plan

• 4 integration tests for policy-gated token exchange (policy_gate.rs)
• 6 integration tests for trust-registry-gated exchange (trust_registry.rs)
• 14 unit tests for trust registry types and matching (trust.rs)
• 5 unit tests for OidcClaims→EvalContext adapter (policy_adapter.rs)
• All 52 bridge tests pass with --all-features
• All 211 policy crate tests pass
• Clippy clean, cargo deny clean, WASM/cross-compile checks pass

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auths	Ready	Preview, Comment	Mar 5, 2026 10:39am