pomerium / pomerium / 21924134758

44%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: add UpstreamOAuthClient type and storage for DCR caching (#6107)

## Summary

Add per-instance caching of RFC 7591 Dynamic Client Registration (DCR)
results in the databroker. DCR registers an OAuth client *application*,
not a per-user credential — so Pomerium should register once per (AS
issuer, downstream host) pair and reuse the resulting
`client_id`/`client_secret` for all users.

- New `UpstreamOAuthClient` proto type with fields: issuer,
downstream_host, client_id, client_secret, redirect_uri,
registration_endpoint, created_at
- New `GetUpstreamOAuthClient` / `PutUpstreamOAuthClient` storage
methods keyed by `dcr|{issuer}|{downstream_host}`
- Validation that issuer and downstream_host are non-empty on put

## Related issues

- [ENG-3572: Cache DCR client registrations per-instance in
databroker](https://linear.app/pomerium/issue/ENG-3572/cache-dcr-client-registrations-per-instance-in-databroker)

## User Explanation

No user-facing changes. This is an internal storage addition for a
future feature (upstream MCP OAuth proxying).

## Checklist

- [x] reference any related issues
- [ ] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

36 of 40 new or added lines in 1 file covered. (90.0%)

31 existing lines in 6 files now uncovered.

32021 of 72651 relevant lines covered (44.08%)

117.85 hits per line