stacklok / toolhive / 24393361220

66%

push

github

Propagate protectedResourceAllowPrivateIP through OIDC resolver and converter (#4784)

* Propagate protectedResourceAllowPrivateIP through OIDC resolver and converter

The protectedResourceAllowPrivateIP CRD field was defined but never
propagated through the OIDC resolver, and the vmcpconfig converter
incorrectly mapped it from jwksAllowPrivateIP. This meant the field
had no effect and could not be controlled independently.

Add ProtectedResourceAllowPrivateIP to the resolver OIDCConfig struct,
propagate it through inline, shared inline, and ConfigMap resolve paths,
fix the converter to use the correct source field, and add the missing
JwksAllowPrivateIP mapping.

Fixes bugs 2 and 3 from #3142.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add ConfigMap independence test for protectedResourceAllowPrivateIP

Address review feedback (F3): add a ConfigMap test case where
jwksAllowPrivateIP is true but protectedResourceAllowPrivateIP is
absent, verifying they resolve independently.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Document runtime OR behavior on private IP fields and fix missing converter mappings

Add doc comments to JWKSAllowPrivateIP and ProtectedResourceAllowPrivateIP
on both InlineOIDCSharedConfig and InlineOIDCConfig noting that at runtime
either field being true enables private IPs for all OIDC HTTP requests.

Also add missing JWKSURL and IntrospectionURL mappings in
mapResolvedOIDCToVmcpConfigFromRef, which silently dropped these fields
for the MCPOIDCConfig reference path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Regenerate CRD manifests after doc comment updates

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Regenerate CRD reference docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

31 of 35 new or added lines in 2 files covered. (88.57%)

56937 of 86755 relevant lines covered (65.63%)

63.08 hits per line