stacklok / toolhive / 23680747332

push

github

Implement upstream_inject strategy and SubjectProviderName (#4390)

* Implement upstream_inject strategy and SubjectProviderName for #4145

Phase 2 of RFC-0054: add the upstream_inject outgoing auth strategy
that injects per-provider upstream IDP tokens into backend requests,
and extend token_exchange to source its subject token from
identity.UpstreamTokens when SubjectProviderName is configured.

- Add UpstreamTokens stub field to Identity with MarshalJSON redaction
- Add UpstreamInjectStrategy (stateless, follows header_injection pattern)
- Extend TokenExchangeStrategy to resolve subject token from upstream
  tokens when SubjectProviderName is set, falling back to identity.Token
- Register upstream_inject in the outgoing auth factory

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Replace IIFE with plain if/else for subject token selection

The anonymous function returning (string, error) obscured control flow
without benefit — error returns exit the closure, not the method. Plain
if/else is idiomatic and matches the rest of the codebase.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Regenerate CRD manifests and docs after rebase

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

81 of 92 new or added lines in 4 files covered. (88.04%)

52625 of 80417 relevant lines covered (65.44%)

63.29 hits per line