stacklok / toolhive / 24727943685

66%

Build Type

push

github

Committed by web-flow

Commit Message

Default redirectUri on upstream providers as documented in CRD (#4905)

* Default redirectUri on upstream providers to {resourceUrl}/oauth/callback

The MCPExternalAuthConfig CRD documents that redirectUri defaults to
{resourceUrl}/oauth/callback when not specified, but the operator was
passing the empty string through to the proxy runner, which then
rejected it with "redirect_uri is required".

Pass resourceURL through BuildAuthServerRunConfig to buildUpstreamRunConfig
so empty RedirectURI fields on both OIDC and OAuth2 upstream providers are
resolved to the documented default before generating the runconfig. This
applies to both MCPServer and VirtualMCPServer code paths.

Fixes #4874

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add unit test for deriveResourceURL in converter_test.go

Address code review feedback: add TestDeriveResourceURL table-driven
test matching the convention established by TestDeriveAllowedAudiences
and TestDeriveScopesSupported. Covers nil IncomingAuth, nil OIDC,
empty Resource, and populated Resource cases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

22 of 22 new or added lines in 2 files covered. (100.0%)

41 existing lines in 5 files now uncovered.

58429 of 87923 relevant lines covered (66.45%)

63.19 hits per line