stacklok / toolhive / 26173440719

push

github

Add default OBO handler hooks and vMCP/proxy converter stubs (#5338)

* Add default OBO handler hooks and vMCP/proxy converter stubs

Stand up the upstream default stub infrastructure for the new `obo`
external auth type at three dispatch layers so an out-of-tree build can
register a real OBO implementation by calling three setter functions
while an upstream-only build hits the defaults and surfaces a sentinel
error at every dispatch point.

Implements changes for issue #5327:

- Add ExternalAuthTypeOBO ExternalAuthType = "obo" constant to the CRD
  types file. CRD enum admission, OBOConfig struct and CEL rule remain
  out of scope and land in the follow-up CRD-admission task.
- Add controllerutil.OBOHandler struct, ErrEnterpriseRequired sentinel,
  RegisterOBOHandler setter and OBOValidate / OBOSecretEnvVars wrappers
  to cmd/thv-operator/pkg/controllerutil/tokenexchange.go. Default
  handler returns ErrEnterpriseRequired from every method.
- Add pkg/auth/obo package exporting MiddlewareType = "obo",
  CreateMiddleware factory variable and RegisterFactory setter. Default
  factory installs a stub Middleware whose Handler responds 503 with a
  body explaining the OBO middleware factory has not been registered.
- Wire obo.MiddlewareType -> obo.CreateMiddleware into the 17-entry
  middleware-factory map in pkg/runner/middleware.go.
- Add OBOConverterStub to pkg/vmcp/auth/converters and register it as
  the built-in StrategyConverter for ExternalAuthTypeOBO inside
  NewRegistry. Every method returns an error wrapping
  ErrEnterpriseRequired so callers can match it via errors.Is.
- Add no-op case ExternalAuthTypeOBO arms to existing switches on
  ExternalAuthType (Validate, AddExternalAuthConfigOptions,
  getExternalAuthConfigSecretEnvVar) to keep the exhaustive linter
  green. These arms preserve the existing default behavior; the actual
  dispatch wiring lives in the follow-up task.
- Add unit tests covering every default stub behavior, last-write-wins
... (continued)

63 of 89 new or added lines in 7 files covered. (70.79%)

64790 of 98921 relevant lines covered (65.5%)

62.88 hits per line