stacklok / toolhive / 24414851013

66%

Build Type

push

github

Committed by web-flow

Commit Message

Allow local key provider to bypass OIDC discovery failure (#4774)

When the vMCP has an embedded auth server, ensureOIDCDiscovered()
fails fatally if the issuer URL is unreachable from inside the
cluster, preventing the local key provider from ever being consulted.

Make the discovery error non-fatal when a keyProvider is configured.
The local provider resolves signing keys in-process, so HTTP-based
OIDC discovery is not required for token validation. When discovery
fails with a keyProvider present, mark it as completed to avoid the
per-request retry penalty (3 attempts with backoff).

When the issuer IS reachable, discovery succeeds normally and the
HTTP JWKS fallback remains available for key ID misses against the
local provider.

Also improve the error message when the local provider cannot resolve
a key and no JWKS URL is available, and add a constructor log
distinguishing deferred discovery from non-fatal discovery.

Fixes #4747

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

26 of 26 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

57514 of 87468 relevant lines covered (65.75%)

62.63 hits per line