fix(auth): cap JWT token-exchange lifetime to subject expiry

[vigneshio]

Internal JWT token exchange no longer issues an access token that outlives the subject token.

Previously each exchange reset expiry to a full maxTokenGeneration window, so a valid (or stolen) access token could be refreshed indefinitely. Exchanged tokens are now capped to the remaining subject lifetime (and still to maxTokenGeneration).

Also stop treating a non-Basic Authorization header as client credentials for the token endpoint; exchange with subject_token alone is allowed but cannot extend session lifetime.

[adutra]

@vigneshio I'm afraid we can't accept this PR 😞

Exchanged tokens are now capped to the remaining subject lifetime

In a "real" token exchange grant, that's indeed the best thing to do. However, here we are abusing the token exchange grant for something it wasn't designed for: refreshing tokens. This is exactly how the Iceberg OAuth2 client behaves. IOW, it's not a bug, it's a feature 😄

stop treating a non-Basic Authorization header as client credentials for the token endpoint;

Same thing: this is indeed non-standard, but that's how the Iceberg client refreshes tokens by default: the Authorization header will contain Bearer <token> and <token> will be identical to the subject token.

[vigneshio]

@vigneshio I'm afraid we can't accept this PR 😞

Exchanged tokens are now capped to the remaining subject lifetime

In a "real" token exchange grant, that's indeed the best thing to do. However, here we are abusing the token exchange grant for something it wasn't designed for: refreshing tokens. This is exactly how the Iceberg OAuth2 client behaves. IOW, it's not a bug, it's a feature 😄

stop treating a non-Basic Authorization header as client credentials for the token endpoint;

Same thing: this is indeed non-standard, but that's how the Iceberg client refreshes tokens by default: the Authorization header will contain Bearer <token> and <token> will be identical to the subject token.

Thanks for the context, @adutra - Makes sense - closing this out.