stacklok / toolhive / 20924023999

58%

Build Type

push

github

Committed by web-flow

Commit Message

Add OAuth authorization server storage interfaces and types (#3245)

This package provides the storage layer for ToolHive's OAuth authorization
server, which acts as a centralized authentication proxy between MCP clients
and upstream identity providers.

The Storage interface composes fosite's OAuth interfaces with custom methods
for managing upstream tokens and pending authorization requests. Segregated
interfaces (PendingAuthorizationStorage, ClientRegistry, UpstreamTokenStorage)
allow components to depend only on the operations they need.

The UpstreamTokens type stores tokens obtained from upstream identity providers
with binding fields (Subject, ClientID) that are validated on lookup to
prevent cross-session attacks. PendingAuthorization tracks the state of
in-flight authorization requests while users authenticate with the upstream
IDP, including PKCE verifiers and OIDC nonces for security.

Run Details

8 of 410 new or added lines in 3 files covered. (1.95%)

2 existing lines in 1 file now uncovered.

34018 of 58805 relevant lines covered (57.85%)

81.9 hits per line