stacklok / toolhive / 17645412382
59%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 231
Run time 5min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 39.974% (-0.01%) from 39.984%
17645412382

push

github

web-flow 
Fix OAuth issuer discovery to comply with RFC 8414 and RFC 9728 (#1839)

- Add support for RFC 9728 Protected Resource Metadata discovery
- Fix issuer detection to properly handle cases where the metadata URL differs from the actual issuer (e.g., Stripe's case)
- Add resource_metadata parameter parsing from WWW-Authenticate header
- Implement FetchResourceMetadata to retrieve protected resource metadata
- Add ValidateAndDiscoverAuthServer to handle issuer validation and discovery
- Update OAuth flow to use pre-discovered endpoints when available
- Fix DeriveIssuerFromRealm to validate realm as a proper HTTPS URL
- Add DiscoverActualIssuer in OIDC package to handle issuer mismatch cases
- Add workaround for resource metadata that incorrectly lists authorization servers that don't match the actual issuer (validates each server and uses the discovered issuer)
- Update tests to reflect the new DeriveIssuerFromRealm function behavior

This fixes the bug where issuer detection was incorrectly trying to derive
the issuer from the remote URL instead of using the realm parameter or
fetching resource metadata as specified in the RFCs.

The implementation now properly handles edge cases like Stripe's where the
resource metadata URL hosts the authorization server metadata but the actual
issuer identifier is different.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

148 of 282 new or added lines in 3 files covered. (52.48%)

29 existing lines in 5 files now uncovered.

12270 of 30695 relevant lines covered (39.97%)

17.06 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
6
89.21
 -3.76% pkg/auth/oauth/oidc.go
61
60.61
 7.47% pkg/auth/discovery/discovery.go
67
0.0
 0.0% pkg/runner/remote_auth.go

Uncovered Existing Lines

Lines Coverage ∆ File
1
0.0
 0.0% pkg/runner/remote_auth.go
2
60.61
 7.47% pkg/auth/discovery/discovery.go
2
92.86
 -1.43% pkg/secrets/keyring/composite.go
3
72.39
 -1.12% pkg/ignore/processor.go
21
48.94
 -22.34% pkg/secrets/keyring/keyctl_linux.go
Jobs
ID Job ID Ran Files Coverage
1 17645412382.1 231
39.97
 GitHub Action Run
Source Files on build 17645412382