stacklok / toolhive / 21705504413

push

github

Align authserver DCR client scopes with discovery scopes_supported (#3610)

DCR was assigning hardcoded DefaultScopes ["openid", "profile", "email"]
to registered clients, while the discovery document advertised whatever
was configured in oidcConfig.inline.scopes. When those differed, clients
would read scopes_supported from discovery, request those scopes, and
get rejected by fosite because the client wasn't allowed them.

For example, with this MCPServer config:

```
    oidcConfig:
      inline:
        scopes: [user:email, read:user, repo]
```

the discovery document would advertise scopes_supported: ["user:email",
"read:user", "repo"], but a DCR client would only be allowed ["openid",
"profile", "email"]. Requesting "user:email" would fail with
invalid_scope.

The fix: DCR now reads h.config.ScopesSupported so clients are allowed
to request exactly the scopes the server advertises. The config default
for ScopesSupported references registration.DefaultScopes directly,
giving a single source of truth instead of two arrays to keep in sync.

5 of 5 new or added lines in 2 files covered. (100.0%)

40822 of 67154 relevant lines covered (60.79%)

79.44 hits per line