stacklok / toolhive / 24410505212

66%

Build Type

push

github

Committed by web-flow

Commit Message

Add --remote-auth-scope-param-name for non-standard OAuth scope parameters (#4712)

* Add --remote-auth-scope-param-name flag for non-standard OAuth scope parameters

Some OAuth providers use non-standard query parameter names for scopes
in the authorization URL. For example, Slack's OAuth v2 requires
user-token scopes in "user_scope" instead of the standard "scope"
parameter. This causes ToolHive's OAuth flow to fail with invalid_scope
errors when connecting to providers like Slack's MCP server.

Add a new --remote-auth-scope-param-name flag that allows users to
override the query parameter name used for scopes. When set, scopes are
sent under the specified parameter name and the standard "scope"
parameter is cleared. The oauth2Config.Scopes field is preserved so
token refresh requests continue to work correctly.

Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

* Address review feedback: fix empty scope= and OIDC fallback path

- Replace SetAuthURLParam("scope", "") with temporarily nil-ing
  oauth2Config.Scopes before AuthCodeURL, then restoring via defer.
  This omits the scope parameter entirely instead of producing an
  invalid empty scope= (RFC 6749 §3.3).
- Propagate ScopeParamName on the OIDC discovery fallback path in
  createOAuthConfig, so --remote-auth-scope-param-name works with
  --remote-auth-issuer as well.
- Strengthen test assertion to verify scope parameter is truly absent,
  not just empty-valued.

Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

* Fix missing swagger docs for scope_param_name field

Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

---------

Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

Coverage Stats

24 of 59 new or added lines in 7 files covered. (40.68%)

5 existing lines in 2 files now uncovered.

57134 of 87034 relevant lines covered (65.65%)

63.12 hits per line