stacklok / toolhive / 25694465932

66%

Build Type

push

github

Committed by web-flow

Commit Message

Delegate tokenexchange HTTP plumbing to pkg/oauthproto (#5226)

Now that pkg/oauthproto owns request construction, body draining, size
limiting, and RFC 6749 token-response parsing, tokenexchange no longer
needs its own copies. Route exchangeToken through
oauthproto.NewFormRequest + oauthproto.DoTokenRequest and drop the
in-package helpers plus the now-unused imports (encoding/json, io,
log/slog, strconv, time).

exchange.go changes:

- Delete createTokenExchangeRequest, executeTokenExchangeRequest,
  parseTokenExchangeResponse, validateResponseStatus, the local
  response struct, and the local maxResponseBodySize constant.
  exchangeToken collapses to three calls: buildFormData,
  oauthproto.NewFormRequest, oauthproto.DoTokenRequest.

- Preserve RFC 8693 Section 2.2.1 at the call site.
  oauthproto.ParseTokenResponse is deliberately permissive about
  token_type (x/oauth2 library parity, Google historically omits it),
  so tokenSource.Token() still enforces both token_type and
  issued_token_type for RFC 8693 compliance. The redundant
  AccessToken-empty check is gone; oauthproto.ParseTokenResponse emits
  "oauth: token response missing access_token (RFC 6749 Section 5.1)"
  centrally.

- Rename buildTokenExchangeFormData to buildFormData now that the
  package context makes the TokenExchange prefix redundant.

- The SubjectTokenType mutation (c.SubjectTokenType = normalized) is
  preserved — pkg/vmcp and pkg/runner read the field post-Validate —
  and pinned by a new TestExchangeConfig_Validate_NormalizesSubjectTokenType
  regression test covering short forms, already-normalized URNs, and
  empty.

Test changes:

- Replace the in-file testResponse struct and responseBuilder helper
  with oauthtest.ResponseBuilder from pkg/oauthproto/oauthtest. The
  shared builder was introduced in the first commit of this series
  specifically so tokenexchange and the upcoming jwtbearer grant stop
  drifting; keeping a local duplicate defeated the point. Same
  tre... (continued)

Coverage Stats

18 of 19 new or added lines in 1 file covered. (94.74%)

100 existing lines in 7 files now uncovered.

63968 of 98434 relevant lines covered (64.99%)

62.61 hits per line