stacklok / toolhive / 21841918310

push

github

Enable OIDC provider support in the embedded auth server (#3720)

Previously, the embedded auth server converted all upstream configs to
OAuth2Config, which meant OIDCProviderImpl was never instantiated even
when the upstream was configured as type "oidc". This caused OIDC
features like ID token validation and automatic discovery to be silently
skipped.

Refactor UpstreamConfig to carry an explicit provider type ("oidc" or
"oauth2") with separate OIDCConfig and OAuth2Config fields. The upstream
factory now dispatches on type, creating OIDCProviderImpl (with OIDC
discovery and ID token validation) for OIDC upstreams and
BaseOAuth2Provider for OAuth2 upstreams. Config validation enforces
mutual exclusivity between the two config fields.

Tested end-to-end with Google as the OIDC upstream:

```yaml
    upstreamProviders:
      - name: google
        type: oidc
        oidcConfig:
          issuerUrl: "https://accounts.google.com"
          clientId: "<google-client-id>"
          clientSecretRef:
            name: google-oauth-secret
            key: client-secret
          redirectUri: "https://example.com/oauth/callback"
          scopes:
            - openid
            - email
```yaml

Fixes: https://github.com/stacklok/stacklok-epics/issues/235

69 of 75 new or added lines in 3 files covered. (92.0%)

42427 of 69089 relevant lines covered (61.41%)

76.08 hits per line