stacklok / toolhive / 23041807322

64%

Build Type

push

github

Committed by web-flow

Commit Message

fix(vmcp): apply outgoing auth credentials during health checks (#4101) (#4118)

Health check probes were sent unauthenticated to backend MCPServers
because both auth strategies short-circuited on the health-check context
marker before injecting any credentials.

HeaderInjectionStrategy: remove the early return — static headers have no
dependency on user identity and must be injected for all requests,
including probes.

TokenExchangeStrategy: instead of a blanket skip, perform an OAuth2
client_credentials grant when client_id + client_secret are configured,
so the health probe carries a valid Bearer token. When credentials are
not configured the probe is still sent unauthenticated (unchanged
behaviour for that case).

Unit tests are updated / added to cover both the fixed header-injection
path and the two token-exchange health-check branches (with and without
client credentials). E2E tests are added in
test/e2e/thv-operator/virtualmcp for both auth strategies, including a
new DeployMockOAuth2ServerWithNodePort helper that lets the test assert
client_credentials grants were actually made to the token endpoint.

Closes: #4101

Co-authored-by: taskbot <taskbot@users.noreply.github.com>

Run Details

19 of 23 new or added lines in 1 file covered. (82.61%)

50 existing lines in 8 files now uncovered.

48477 of 75314 relevant lines covered (64.37%)

72.91 hits per line