stacklok / toolhive / 23305122120

push

github

Wire non-interactive registry auth for serve mode (#4111)

* Add serve-mode registry auth to thv serve API

Wire non-interactive registry auth for serve mode so that browser-based
OAuth flows are never triggered from the API server. When registry auth
is configured but tokens are missing or expired, the API returns a
structured 503 response with code "registry_auth_required" instead of
hanging on a browser redirect.

Key changes:
- Add WithInteractive(false) provider option for headless contexts
- Add GetNonInteractiveProviderWithConfig for serve mode
- Add auth status fields (auth_status, auth_type) to registry API responses
- Add POST /auth/login and POST /auth/logout API endpoints
- Add auth fields to PUT registry endpoint with offline_access scope
- Return structured 503 errors when registry auth is required
- Wrap validation probe 401 with ErrRegistryAuthRequired

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs

Signed-off-by: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com>

* Return OAuth public config in registry GET responses

Clients like Studio need to display the configured issuer and client_id
without reading the config file directly. Add an auth_config field to
the GET /registry and GET /registry/default responses that surfaces the
non-secret OAuth configuration (issuer, client_id, audience, scopes).
The field is omitted when no auth is configured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* updates docs

Signed-off-by: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com>

---------

Signed-off-by: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

43 of 240 new or added lines in 5 files covered. (17.92%)

49764 of 76983 relevant lines covered (64.64%)

211.52 hits per line