修正协议处理并解耦可选遥测

internal/protocol/token_exchange_test.go

@@ -36,6 +36,7 @@ func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
 		{name: "missing audience", mutate: func(v url.Values) { v.Del("audience") }, code: "invalid_target"},
 		{name: "multiple audiences", mutate: func(v url.Values) { v.Add("audience", "second") }, code: "invalid_target"},
 		{name: "missing scope", mutate: func(v url.Values) { v.Del("scope") }, code: "invalid_scope"},
+		{name: "resource target", mutate: func(v url.Values) { v.Set("resource", "https://example.test") }, code: "invalid_target"},
 		{name: "actor token", mutate: func(v url.Values) { v.Set("actor_token", "not-supported") }, code: "invalid_request"},
 	}
 
@@ -56,6 +57,14 @@ func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
 	}
 }
 
+func TestParseExchangeRequestIgnoresUnknownParameters(t *testing.T) {
+	form := validForm()
+	form.Set("future_extension", "ignored")
+	if _, err := ParseExchangeRequest(form); err != nil {
+		t.Fatalf("ParseExchangeRequest() error = %v", err)
+	}
+}
+
 func validForm() url.Values {
 	return url.Values{
 		"grant_type":           {TokenExchangeGrantType},