stacklok / toolhive / 21360303612

60%

push

github

Add header forward configuration and wire middleware in runner (#3427)

* Add HeaderForwardConfig types and builder options

Define the configuration model for header forwarding in RunConfig:
- HeaderForwardConfig with AddPlaintextHeaders and AddHeadersFromSecret
- Non-serialized resolvedHeaders field to hold merged values in memory
- ResolvedHeaders() accessor for middleware consumption
- HasHeaders() nil-safe method for checking configuration presence
- resolveHeaderForwardSecrets builds merged map without mutating
  AddPlaintextHeaders, keeping secret values out of serialized state
- WithHeaderForward and WithHeaderForwardSecrets builder options
  with additive semantics (multiple calls merge)

Plaintext values are stored as-is in RunConfig. Secret references are
stored by name and resolved at runtime into the non-serialized
resolvedHeaders field, ensuring actual values are never persisted.

* Move middleware creation after secret processing

Relocate PopulateMiddlewareConfigs, the middleware factory loop, and
the transportConfig assignments to after WithSecrets() runs. This
ensures that any secrets resolved during WithSecrets (such as header
forward secrets) are available when middleware factories are invoked.

No behavior change for existing code since no middlewares currently
depend on resolved secrets.

* Wire header forward middleware in runner

Register the header-forward middleware factory and integrate it into
the middleware pipeline:
- Add factory to GetSupportedMiddlewareFactories()
- addHeaderForwardMiddleware helper passes ResolvedHeaders() to the
  factory, which includes both plaintext and resolved secret values
- Place header-forward at the end of PopulateMiddlewareConfigs (just
  before recovery) so it executes innermost, closest to the backend
- In Runner.Run(), append header-forward after secret resolution for
  the pre-populated MiddlewareConfigs path (consistent ordering)
- Add NOTE in WithMiddlewareFromFlags explaining why head... (continued)

97 of 123 new or added lines in 4 files covered. (78.86%)

38114 of 63444 relevant lines covered (60.08%)

77.6 hits per line