• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 25739523544
66%

Build:
DEFAULT BRANCH: main
Ran 12 May 2026 02:08PM UTC
Jobs 1
Files 728
Run time 3min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

12 May 2026 02:02PM UTC coverage: 65.166% (+0.05%) from 65.118%
25739523544

push

github

web-flow
Add RFC 7523 JWT Bearer grant package (#5262)

Add pkg/oauthproto/jwtbearer, a self-contained client for the JWT
Bearer token grant defined by RFC 7523 Section 2.1. The grant exchanges
a signed JWT assertion for an OAuth 2.0 access token at a target
authorization server's token endpoint.

TokenURL validation reuses pkg/networking.ValidateEndpointURL plus
host, fragment, and userinfo checks to enforce RFC 6749 Section 3.2
(token endpoints must use TLS) and to reject URLs that smuggle
credentials in the URL itself. The token_type field in the success
response is validated as required by RFC 6749 Section 5.1. HTTP error
responses are returned as *oauth2.RetrieveError (from
golang.org/x/oauth2) with the raw Body scrubbed before return, matching
pkg/oauthproto/tokenexchange's stricter behavior so error strings
cannot leak upstream content into logs.

Client authentication is HTTP Basic per RFC 6749 Section 2.3.1; the
package targets confidential clients per XAA / ID-JAG §8.1 and does not
support public-client identification via a body client_id parameter.

Also add the GrantTypeJWTBearer URN constant to pkg/oauthproto, the
first consumer of which is this package.

The jwtbearer package is the Step B primitive used by the XAA (ID-JAG)
strategy. It has no XAA-specific behaviour at this layer and works for
any RFC 7523 JWT-Bearer exchange with a confidential client.

72 of 78 new or added lines in 1 file covered. (92.31%)

21 existing lines in 2 files now uncovered.

64269 of 98624 relevant lines covered (65.17%)

61.81 hits per line

Uncovered Changes

Lines Coverage ∆ File
6
92.31
pkg/oauthproto/jwtbearer/grant.go

Coverage Regressions

Lines Coverage ∆ File
18
20.99
3.27% pkg/updates/client.go
3
79.38
-0.77% pkg/transport/proxy/httpsse/http_proxy.go
Jobs
ID Job ID Ran Files Coverage
1 25739523544.1 12 May 2026 02:08PM UTC 728
65.17
GitHub Action Run
Source Files on build 25739523544
  • Tree
  • List 728
  • Changed 5
  • Source Changed 1
  • Coverage Changed 5
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #25739523544
  • 110b9a73 on github
  • Prev Build on main (#25735040765)
  • Next Build on main (#25745160312)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc