feat(sts): enable custom STS endpoint URL

crates/sts/src/lib.rs

@@ -12,7 +12,7 @@
 //! use multistore_sts::route_handler::StsRouterExt;
 //!
 //! let router = Router::new()
-//!     .with_sts(config, jwks_cache, token_key);
+//!     .with_sts("/.sts", config, jwks_cache, token_key);
 //! ```
 //!
 //! # Flow

crates/sts/src/route_handler.rs

@@ -27,13 +27,14 @@ impl<C: CredentialRegistry> RouteHandler for StsHandler<C> {
 
 /// Extension trait for registering STS routes on a [`Router`].
 pub trait StsRouterExt {
-    /// Register the STS handler on the root path (`/`).
+    /// Register the STS handler on the given `path`.
     ///
     /// STS requests are identified by query parameters
-    /// (`Action=AssumeRoleWithWebIdentity`), not by path, and clients
-    /// always send them to `/`.
+    /// (`Action=AssumeRoleWithWebIdentity`), not by path, so any path
+    /// can be used (e.g. `"/"` or `"/.sts"`).
     fn with_sts<C: CredentialRegistry + 'static>(
         self,
+        path: &str,
         config: C,
         cache: JwksCache,
         key: Option<TokenKey>,
@@ -43,11 +44,12 @@ pub trait StsRouterExt {
 impl StsRouterExt for Router {
     fn with_sts<C: CredentialRegistry + 'static>(
         self,
+        path: &str,
         config: C,
         cache: JwksCache,
         key: Option<TokenKey>,
     ) -> Self {
-        self.route("/", StsHandler { config, cache, key })
+        self.route(path, StsHandler { config, cache, key })
     }
 }
 
@@ -75,7 +77,7 @@ mod tests {
 
     fn test_router() -> Router {
         let cache = JwksCache::new(reqwest::Client::new(), std::time::Duration::from_secs(60));
-        Router::new().with_sts(EmptyRegistry, cache, None)
+        Router::new().with_sts("/", EmptyRegistry, cache, None)
     }
 
     #[tokio::test]

examples/cf-workers/src/lib.rs

@@ -77,7 +77,7 @@ async fn fetch(req: web_sys::Request, env: Env, _ctx: Context) -> Result<web_sys
     if let (Some(signer), Some(issuer)) = (oidc_signer, oidc_issuer) {
         router = router.with_oidc_discovery(issuer, vec![signer]);
     }
-    router = router.with_sts(sts_creds, jwks_cache, token_key.clone());
+    router = router.with_sts("/.sts", sts_creds, jwks_cache, token_key.clone());
 
     // Build the gateway with the router.
     let mut gateway = ProxyGateway::new(WorkerBackend, config.clone(), config, virtual_host_domain)

examples/lambda/src/main.rs

@@ -95,7 +95,7 @@ async fn main() -> Result<(), Error> {
     if let (Some(signer), Some(issuer)) = (oidc_signer, oidc_issuer) {
         router = router.with_oidc_discovery(issuer, vec![signer]);
     }
-    router = router.with_sts(sts_creds, jwks_cache, token_key.clone());
+    router = router.with_sts("/.sts", sts_creds, jwks_cache, token_key.clone());
 
     // Build the gateway with the router.
     let mut handler = ProxyGateway::new(backend, config.clone(), config, domain)

examples/server/src/server.rs

@@ -115,7 +115,7 @@ where
     if let (Some(signer), Some(issuer)) = (oidc_signer, oidc_issuer) {
         proxy_router = proxy_router.with_oidc_discovery(issuer, vec![signer]);
     }
-    proxy_router = proxy_router.with_sts(sts_creds, jwks_cache, token_key.clone());
+    proxy_router = proxy_router.with_sts("/.sts", sts_creds, jwks_cache, token_key.clone());
 
     // Build the gateway with the router.
     let mut handler = ProxyGateway::new(

tests/integration/test_integration.py

@@ -29,7 +29,7 @@
 def assume_role(role_arn: str, oidc_token: str) -> dict:
     """Assume a role via the STS proxy and return parsed credentials."""
     resp = requests.get(
-        PROXY_URL,
+        f"{PROXY_URL}/.sts",
         params={
             "Action": "AssumeRoleWithWebIdentity",
             "RoleArn": role_arn,

tests/smoke/test_smoke.py

@@ -21,7 +21,7 @@
 def assume_role(role_arn: str, oidc_token: str) -> dict:
     """Assume a role via the STS proxy and return parsed credentials."""
     resp = requests.get(
-        DEPLOY_URL,
+        f"{DEPLOY_URL}/.sts",
         params={
             "Action": "AssumeRoleWithWebIdentity",
             "RoleArn": role_arn,