stacklok / toolhive / 24510042617

push

github

Use scoped secrets provider for registry auth (#4893)

After secret scope migration runs, registry tokens are moved from bare
keys (REGISTRY_OAUTH_*) to the scoped namespace (__thv_registry_*).
The factory and API login/logout handlers were still using the bare
provider, so token lookups failed after migration and returned 401.

Switch factory.go and the API registry auth handler to use
CreateProvider with WithScope(ScopeRegistry). ScopedProvider.GetSecret
falls back to bare keys during the migration window, and all new
reads/writes go through the scoped namespace consistently.

Also fix EncryptedManager.DeleteSecret to return ErrSecretNotFound
(matching GetSecret) so callers relying on IsNotFoundError handle
delete-not-found correctly.

Fix #4892

1 of 3 new or added lines in 3 files covered. (33.33%)

57254 of 86735 relevant lines covered (66.01%)

62.85 hits per line