stacklok / toolhive / 24473565393

66%

Build Type

push

github

Committed by web-flow

Commit Message

Add resourceUrl field to MCPOIDCConfigReference (#4855)

* Add resourceUrl field to MCPOIDCConfigReference

When a VirtualMCPServer is exposed via Ingress, the protected resource
metadata (RFC 9728) must advertise the public URL, not the internal
Kubernetes service URL. Without this, oidcConfigRef is unusable for any
externally-exposed server because MCP clients receive an unreachable
internal address.

Add an optional resourceUrl field to MCPOIDCConfigReference that
overrides the derived service URL. When empty, the existing fallback to
the internal service URL is preserved.

Closes #4851

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add integration test for oidcConfigRef resourceUrl override

Verify end-to-end that when a VirtualMCPServer sets resourceUrl on its
oidcConfigRef, the generated ConfigMap contains the explicit public URL
instead of the internal Kubernetes service URL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Strengthen OIDC integration tests to assert all resolved fields

The existing ConfigMap assertion only checked Issuer and Audience.
Expand it to also verify ClientID, Scopes, and the derived Resource URL,
ensuring full field propagation from MCPOIDCConfig + MCPOIDCConfigReference
through to the generated runconfig. The resourceUrl override test now also
asserts all fields, not just Resource.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Consolidate OIDC integration tests into single context

Fold the resourceUrl override test into the existing VirtualMCPServer
context instead of duplicating the full setup. The first context now
sets ResourceURL on the ref and asserts all resolved fields including
the explicit resource URL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update cmd/thv-operator/test-integration/mcp-oidc-config/mcpoidcconfig_virtualmcpserver_integration_test.go

* Address review feedback: fix comment, add fall... (continued)

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

8 existing lines in 2 files now uncovered.

57232 of 87023 relevant lines covered (65.77%)

62.62 hits per line