stacklok / toolhive / 24904854536

67%

Build Type

push

github

Committed by web-flow

Commit Message

Treat 401/403 from auth-configured backends as healthy (#4935)

Health probes run as background system checks with no user context, so
they cannot carry the per-user upstream tokens that upstream_inject
backends require. For OAuth-protected backends, a 401/403 challenge is
the expected response to an unauthenticated probe and proves the backend
is reachable, its auth layer works, and the network path is sound.

Map auth errors to BackendHealthy when the backend has an outgoing auth
strategy configured; keep BackendUnauthenticated only as a narrower
misconfiguration signal (backend demands auth, none configured). This
unblocks discovery from excluding OAuth-protected backends from
capability aggregation (resolves the TODO at discovery/middleware.go).

Drop the `|| BackendUnauthenticated` clause from /status since the state
now represents misconfig rather than routability. Legacy PR #4866
routability semantics in monitor.go are left in place with a TODO for a
follow-up revert; they touch operator controllers and warrant a separate
PR.

Closes #4920

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

23 of 24 new or added lines in 3 files covered. (95.83%)

25 existing lines in 6 files now uncovered.

59203 of 89356 relevant lines covered (66.26%)

62.44 hits per line