stacklok / toolhive / 17824288401
50%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 259
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 43.973% (+0.03%) from 43.943%
17824288401

push

github

web-flow 
Enable token exchange for the example KC clients (#1930)

Extends the keycloak setup script we have with settings to perform a
token exchange of tokens with aud=mcp-servers for tokens with
aud=backend. To test:
```
TOKEN=$(curl -s -d "client_id=mcp-test-client" -d "client_secret=mcp-test-client-secret" -d "username=toolhive-user" -d "password=user123" -d "grant_type=password" "http://localhost:8080/realms/toolhive/protocol/openid-connect/token" | jq -r '.access_token')

curl -s -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
        -d "client_id=mcp-server" \
        -d "client_secret=PLOs4j6ti521kb5ZVVwi5GWi9eDYTwq" \
        -d "subject_token=$TOKEN" \
        -d "subject_token_type=urn:ietf:params:oauth:token-type:access_token" \
        -d "scope=backend-access" \
        "http://localhost:8080/realms/toolhive/protocol/openid-connect/token"
```

Which gives you a token like:
```
{
  "exp": 1758154725,
  "iat": 1758151125,
  "jti": "ntrtte:3030a890-c9e7-65d6-8113-67758e5cbc22",
  "iss": "http://keycloak:8080/realms/toolhive",
  "aud": [
    "backend",
    "account"
  ],
  "sub": "3430d8ae-f15a-45cc-8bf0-6ab626312b59",
  "typ": "Bearer",
  "azp": "mcp-server",
  "sid": "10d002b5-c35a-4e90-8763-e96f6ef13eed",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "default-roles-toolhive",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "profile backend-access email",
  "email_verified": true,
  "name": "ToolHive User",
  "preferred_username": "toolhive-user",
  "given_name": "ToolHive",
  "family_name": "User",
  "email": "user@toolhive.example.com"
}
```

14898 of 33880 relevant lines covered (43.97%)

16.17 hits per line

Uncovered Existing Lines

Lines Coverage ∆ File
1
94.29
 1.43% pkg/secrets/keyring/composite.go
6
64.89
 15.96% pkg/secrets/keyring/keyctl_linux.go
6
43.21
 -0.78% pkg/workloads/manager.go
Jobs
ID Job ID Ran Files Coverage
1 17824288401.1 259
43.97
 GitHub Action Run
Source Files on build 17824288401