stacklok / toolhive / 24524851874

66%

Build Type

push

github

Committed by web-flow

Commit Message

Detect JSON-RPC application errors in proxy audit middleware (#4709)

* Detect JSON-RPC application errors in proxy audit middleware

The audit middleware previously determined outcome solely from the HTTP
status code. Because MCP servers return errors inside HTTP 200 responses
per the JSON-RPC spec, application-level failures (expired tokens, API
errors, invalid parameters) were logged as outcome=success, making them
invisible in audit logs.

This change inspects the response body for a JSON-RPC error field when
the HTTP status is 200. If found, the outcome is recorded as
application_error with the error code and truncated message in metadata.

A new DetectApplicationErrors config flag (default true) controls the
behavior independently of IncludeResponseData, avoiding the need to
enable full response capture just for error detection.

Fixes #4678

Signed-off-by: Guillermo Gomez <guillermogomezmora@gmail.com>

* Fix lint and regenerate swagger docs

- Extract detectApplicationError into separate method to reduce
  cyclomatic complexity of logAuditEvent (gocyclo > 15)
- Fix gci import formatting in config.go
- Regenerate swagger docs for new DetectApplicationErrors config field

Signed-off-by: Guillermo Gomez <guillermogomezmora@gmail.com>

* Wire detectApplicationError into logAuditEvent

Replace inline JSON-RPC error detection logic with a call to the
extracted detectApplicationError method, fixing both the gocyclo
complexity violation and the unused function lint error.

Signed-off-by: Guillermo Gomez <guillermogomezmora@gmail.com>

* Regenerate CRD manifests and docs for DetectApplicationErrors field

Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

---------

Signed-off-by: Guillermo Gomez <guillermogomezmora@gmail.com>
Signed-off-by: Gustavo Gomez <gmogmz@indeed.com>

Coverage Stats

65 of 71 new or added lines in 3 files covered. (91.55%)

6 existing lines in 3 files now uncovered.

57486 of 86942 relevant lines covered (66.12%)

63.34 hits per line