stacklok / toolhive / 26299481722

66%

push

github

Admit obo in MCPExternalAuthConfig CRD enum (#5361)

* Admit obo in MCPExternalAuthConfig CRD enum

Until this commit, the apiserver enum on MCPExternalAuthConfig.spec.type
did not list "obo", so applying an obo-typed CR was rejected at admission
before the previously-landed dispatch wiring could run.

Implements changes for issue #5329:
- Extend the CRD enum, CEL rules, and Go-level
  validateTypeConfigConsistency check on MCPExternalAuthConfigSpec to
  admit and validate the new "obo" type alongside the existing seven
- Declare an opaque OBOConfig placeholder struct and spec.obo field; the
  inner schema lands in a follow-up
- Document the two-tier validation pattern on the Validate() OBO arm:
  structural validation here, semantic validation behind the
  controllerutil.OBOValidate function-pointer hook at reconcile time
- Regenerate operator-crds chart YAML, deepcopy, and public CRD reference
- Add unit tests covering the OBO validation matrix and update existing
  OBO-typed test fixtures across operator and vMCP packages

* Justify gocyclo suppression and document unauthenticated guard intent

Address code-review feedback on the CRD admission change:

- Expand the doc comment on validateTypeConfigConsistency so the
  //nolint:gocyclo directive meets the "confirmed false positive"
  bar from .claude/rules/go-style.md. The per-type if shape mirrors
  the CEL rules on MCPExternalAuthConfigSpec one-to-one; collapsing
  into a table-driven loop would obscure that correspondence.
- Add an explanatory comment on the unauthenticated guard so it
  reads as shape-parity / belt-and-braces, not load-bearing
  validation. The per-type biconditionals above always intercept a
  populated config field first; the guard exists so a future
  contributor adding a type cannot forget to extend the invariant.

* Polish OBO admission comments and test names

Addresses stacklok/toolhive#5361 review comments:
- LOW types.go (3283528614): F1 — say unauthenticated-guard OBO ... (continued)

24 of 34 new or added lines in 2 files covered. (70.59%)

65199 of 99008 relevant lines covered (65.85%)

62.88 hits per line