24718682366
66%

Ran 21 Apr 2026 11:04AM UTC

Jobs 1

Files 653

Run time 2min

Badge

Embed ▾

Committed 21 Apr 2026 10:59AM UTC coverage: 66.445% (-0.006%) from 66.451%

Build # 24718682366

Build Type

push

github

Committed by

web-flow

Commit Message

Add unit and integration tests for Cedar group-based authorization (#4964)

The dual-claim extraction, dot-notation traversal, and merge-order fix
from 88937fce lacked direct unit tests for helper functions and had no
integration tests exercising group-based Cedar policies through the
middleware stack. This closes both gaps.

Tier 1 — unit tests for parseCedarEntityID, sanitizeURIForCedar,
extractClientIDFromClaims, preprocessClaims, preprocessArguments,
mergeContexts, and IsAuthorized entity merge priority. Adds edge cases
to existing TestResolveNestedClaim (ambiguity) and
TestAuthorizeWithJWTClaims_DualClaim (same claim, missing JWT key,
non-array graceful handling, both dot-notation).

Tier 2 — integration tests for group-based list filtering (Entra dual,
Entra groups, Okta URI, Keycloak nested, prompts, resources), non-list
operations (tool call, prompt get, resource read), transitive
THVGroup→THVRole hierarchy through middleware, and upstream provider
group extraction.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Coverage Stats

58398 of 87889 relevant lines covered (66.45%)

62.57 hits per line

Coverage Regressions

Lines	Coverage	∆	File
6	76.15	-5.5%	pkg/secrets/keyring/keyctl_linux.go
2	93.94	-6.06%	pkg/foreach/foreach.go
2	82.29	-0.21%	pkg/vmcp/composer/workflow_engine.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	24718682366.1	21 Apr 2026 11:04AM UTC	653	66.45	GitHub Action Run

stacklok / toolhive / 24718682366
66%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 24718682366

stacklok / toolhive / 24718682366 66%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 24718682366

stacklok / toolhive / 24718682366
66%

README BADGES
x