stacklok / toolhive / 25439938257

65%

Build Type

push

github

Committed by web-flow

Commit Message

fix(api,cli): stop auto-deriving RFC 8707 resource indicator from URL (#5204)

* fix(api): stop auto-deriving RFC 8707 resource indicator from URL

The API path unconditionally derived the RFC 8707 resource parameter
from the server URL, while the CLI only did so when --resource-url was
explicitly passed. This broke OAuth for servers like Common Room that
don't support RFC 8707.

Remove the automatic URL-to-resource fallback in both
buildRemoteAuthConfigFromMetadata and createRequestToRemoteAuthConfig,
keeping only user-provided and metadata-provided resource values.

Fixes: #5203

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test(api): add resource indicator tests for createRequestToRemoteAuthConfig

Verify that resource is NOT auto-derived from URL when not explicitly
set, and that an explicitly provided resource is preserved verbatim.
These tests guard against re-introducing the removed fallback derivation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api,cli): remove auto-derivation of RFC 8707 resource from all paths

Also fix the CLI registry path (getRemoteAuthFromRemoteServerMetadata)
which had the same unconditional fallback to DefaultResourceIndicator.
Inline orphaned variable in createRequestToRemoteAuthConfig.

The resource parameter is now only set when explicitly provided by the
user or registry metadata, matching the behavior of the direct CLI path
which gates on --resource-url.

Refs: #5203

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: address review nits — clarify comments

Add explanatory comment on registry path resource assignment
explaining why --resource-url derivation is intentionally skipped.
Reword test comment to be reader-facing rather than author-local.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

1 of 6 new or added lines in 2 files covered. (16.67%)

258 existing lines in 9 files now uncovered.

62877 of 97205 relevant lines covered (64.68%)

59.09 hits per line