stacklok / toolhive / 21248927371

71%

Build Type

push

github

Committed by web-flow

Commit Message

Skip token injection when token exchange active (#3385)

When token exchange middleware is configured, it handles its own
Authorization header injection. The oauth-token-injection middleware
was being added anyway, potentially overwriting the exchanged token
with the original OAuth token.

Add hasTokenExchangeMiddleware() to detect when token exchange is
present and skip adding the redundant token injection middleware.
Also fix the middleware name in proxy.go to use the MiddlewareType
constant for consistent detection.

In practical terms what this enables is easier testing with:
```
  thv run \
    --token-exchange-audience 'backend' \
    --token-exchange-client-id blablabla \
    --token-exchange-client-secret foobar \
    --token-exchange-scopes 'backend-api:read' \
    --token-exchange-url https://blah \
    --remote-auth-bearer-token-file $(pwd)/token.auth \
```

What the fix enables is to read the token using the remote-auth

Coverage Stats

6 of 10 new or added lines in 2 files covered. (60.0%)

13 existing lines in 4 files now uncovered.

36252 of 61000 relevant lines covered (59.43%)

80.59 hits per line