修正协议处理并解耦可选遥测

internal/protocol/token_exchange.go

@@ -64,9 +64,12 @@ func ParseExchangeRequest(form url.Values) (ExchangeRequest, error) {
 	if len(request.Scopes) == 0 {
 		return ExchangeRequest{}, requestError("invalid_scope", "scope is required")
 	}
-	for _, unsupported := range []string{"resource", "actor_token", "actor_token_type"} {
-		if form.Has(unsupported) {
-			return ExchangeRequest{}, requestError("invalid_request", unsupported+" is not supported")
+	if form.Has("resource") {
+		return ExchangeRequest{}, requestError("invalid_target", "resource target is not supported")
+	}
+	for _, actorParameter := range []string{"actor_token", "actor_token_type"} {
+		if form.Has(actorParameter) {
+			return ExchangeRequest{}, requestError("invalid_request", "actor token is not supported")
 		}
 	}
 

internal/protocol/token_exchange_test.go

@@ -36,6 +36,7 @@ func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
 		{name: "missing audience", mutate: func(v url.Values) { v.Del("audience") }, code: "invalid_target"},
 		{name: "multiple audiences", mutate: func(v url.Values) { v.Add("audience", "second") }, code: "invalid_target"},
 		{name: "missing scope", mutate: func(v url.Values) { v.Del("scope") }, code: "invalid_scope"},
+		{name: "resource target", mutate: func(v url.Values) { v.Set("resource", "https://example.test") }, code: "invalid_target"},
 		{name: "actor token", mutate: func(v url.Values) { v.Set("actor_token", "not-supported") }, code: "invalid_request"},
 	}
 
@@ -56,6 +57,14 @@ func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
 	}
 }
 
+func TestParseExchangeRequestIgnoresUnknownParameters(t *testing.T) {
+	form := validForm()
+	form.Set("future_extension", "ignored")
+	if _, err := ParseExchangeRequest(form); err != nil {
+		t.Fatalf("ParseExchangeRequest() error = %v", err)
+	}
+}
+
 func validForm() url.Values {
 	return url.Values{
 		"grant_type":           {TokenExchangeGrantType},