stacklok / toolhive / 19424386682

51%

push

github

Fix RFC 7591 scope serialization format (#2597)

* Fix RFC 7591 scope serialization format

Dynamic client registration was sending scopes as a JSON array
instead of a space-delimited string, violating RFC 7591 Section 2.

Changes:
- Add RequestScopeList type with custom MarshalJSON method
- Convert scope arrays to space-delimited strings per RFC 7591
- Update DynamicClientRegistrationRequest to use RequestScopeList
- Update tests to verify RFC 7591 compliance
- Remove TODO comments about the format violation

The ScopeList type for responses already handles both formats
(string and array) for maximum provider compatibility.

Fixes #2596

Signed-off-by: Claude <noreply@anthropic.com>

* Add INFO logging to demonstrate RFC 7591 scope marshaling

Adds informative logging to show the transformation of RequestScopeList
from Go slice to RFC 7591 compliant space-delimited string format.

Tested successfully against Atlassian MCP OAuth server:
- Input: [openid profile email]
- Output: "openid profile email" (space-delimited string)
- Result: Successful dynamic client registration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Change RFC 7591 scope marshaling logging to DEBUG level

The INFO level logging was useful for validating RFC 7591 compliance
during testing, but DEBUG is more appropriate for production use.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Simplify RequestScopeList.MarshalJSON by removing unnecessary null check

The previous implementation returned null for empty slices to work with
omitempty, but testing revealed that omitempty checks the Go value (empty
slice) BEFORE calling MarshalJSON. This means:

1. Empty/nil slices are omitted by omitempty at the struct level
2. MarshalJSON is never called for empty slices
3. The null return was dead code

Simplified implementation:
- Removed unnecessary empty sli... (continued)

12 of 12 new or added lines in 1 file covered. (100.0%)

24228 of 49254 relevant lines covered (49.19%)

60.63 hits per line