• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 25511991371
65%

Build:
DEFAULT BRANCH: main
Ran 07 May 2026 05:41PM UTC
Jobs 1
Files 720
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

07 May 2026 05:36PM UTC coverage: 64.809% (+0.01%) from 64.799%
25511991371

push

github

web-flow
Expose explicit primaryUpstreamProvider for Cedar authz on VirtualMCPServer (#5199)

* Expose primaryUpstreamProvider on InlineAuthzConfig

Adds an optional primaryUpstreamProvider field to the inline authz config
on VirtualMCPServer so users with multiple upstream IDPs can pin Cedar to
a non-first provider, instead of being silently bound to whichever
upstream happens to be listed first.

Changes for issue #5197:
- Add PrimaryUpstreamProvider to InlineAuthzConfig (shared type, vMCP-only
  in practice, mirroring the SubjectProviderName precedent on the token-
  exchange and AWS-STS strategies).
- Switch the converter from unconditional first-upstream binding to an
  explicit-then-fallback resolution; both branches normalize through
  authserver.ResolveUpstreamName.
- Reject the spec with AuthServerConfigValidated=False
  (AuthzUpstreamUnknown) when the explicit name does not match any
  declared upstream — Cedar would otherwise deny every request at runtime.
- Suppress the AuthzUpstreamSelectionWarning advisory when the user has
  set the field explicitly; the auto-selection it warns about is no
  longer happening.
- Extend converter and validator tests; regenerate CRD YAMLs and API
  docs.

Existing manifests without the new field keep current behavior — the
fallback branch is unchanged for that path.

* Address code review feedback

Fixed issues from code review:
- MEDIUM: Reject explicit primaryUpstreamProvider when no embedded auth
  server is configured. The early-return direct-IdP branch in
  validateAuthzUpstreamAvailable now checks for a non-empty explicit
  name first and returns SpecValidationError with
  ConditionReasonAuthzUpstreamUnknown when set — closing the silent
  misconfiguration where the converter would forward an unresolvable
  name into Cedar config at runtime.
- MEDIUM: Update the converter block comment so it accurately describes
  both rejection paths (mismatch with declared upstreams AND explicit
  name without an embedded A... (continued)

106 of 122 new or added lines in 5 files covered. (86.89%)

37 existing lines in 5 files now uncovered.

63344 of 97739 relevant lines covered (64.81%)

59.06 hits per line

Uncovered Changes

Lines Coverage ∆ File
8
61.53
-0.1% cmd/thv-operator/controllers/mcpremoteproxy_controller.go
8
66.74
-0.11% cmd/thv-operator/controllers/mcpserver_controller.go

Coverage Regressions

Lines Coverage ∆ File
12
75.09
-4.33% pkg/client/config.go
12
67.9
-14.81% pkg/client/discovery.go
8
23.56
-4.6% pkg/client/manager.go
3
80.67
-0.77% pkg/transport/proxy/httpsse/http_proxy.go
2
94.77
-1.31% pkg/vmcp/composer/dag_executor.go
Jobs
ID Job ID Ran Files Coverage
1 25511991371.1 07 May 2026 05:41PM UTC 720
64.81
GitHub Action Run
Source Files on build 25511991371
  • Tree
  • List 720
  • Changed 14
  • Source Changed 6
  • Coverage Changed 14
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #25511991371
  • c90d01e9 on github
  • Prev Build on main (#25505472220)
  • Next Build on main (#25518577229)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc