stacklok / toolhive / 23592475437

65%

Build Type

push

github

Committed by web-flow

Commit Message

Fall through to well-known discovery when resource metadata auth fails (#4371)

When a server returns resource_metadata in its WWW-Authenticate header,
Priority 3 (RFC 9728) would hard-return on any failure, preventing
Priorities 4 and 5 from running. For servers like Sourcegraph and
Deepsearch whose authorization_servers list contains path-based URLs
(e.g. /.api/mcp/deepsearch), RFC 8414 tenant extraction generates
/.well-known/oauth-authorization-server/.api/mcp/deepsearch — an
endpoint those servers don't serve. Validation fails, Priority 3
errors, and auth is broken despite Priorities 4/5 being able to
derive the correct root-domain issuer.

Fix by capturing the error from tryDiscoverFromResourceMetadata and
only returning on success; failures now log at DEBUG and fall through
to well-known probing (Priority 4) and URL-derived issuer (Priority 5),
restoring the behaviour that existed before 6cad0b59.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Run Details

5 of 5 new or added lines in 1 file covered. (100.0%)

4 existing lines in 2 files now uncovered.

52057 of 79746 relevant lines covered (65.28%)

65.24 hits per line