stacklok / toolhive / 27304005142
67%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 751
Run time 3min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 66.436% (-0.002%) from 66.438%
27304005142

push

github

web-flow 
Cover Serve-path authz and annotation-enrichment omission (#5482)

* Cover Serve-path authz/annotation omission

P2.3 of the vMCP core refactor (epic #5419). The Serve-built *Server
must produce the MCP middleware chain WITHOUT the HTTP authz and
annotation-enrichment layers — authorization moves to the core admission
seam (#5438) — while the still-live server.New path keeps enforcing authz
with no regression.

The nil-guard mechanism already exists: Serve leaves cfg.AuthzMiddleware
nil (buildServeConfig does not map it), so the shared (*Server).Handler
guards at server.go:614/:622 skip both blocks. This change locks that
contract in and corrects forward-reference comments that the revised
plan made stale.

- Add TestServeOmitsAuthzAndAnnotation: a Serve-built server has
  config.AuthzMiddleware == nil and still builds its Handler.
- Add TestHandlerAppliesAuthzAndAnnotationOnlyWhenConfigured: the shared
  Handler applies both layers iff AuthzMiddleware != nil, proving it
  serves both modes and the blocks are not deleted.
- Sync stale #5441 comments: physical removal of the inert blocks moves
  to Phase 3 (#5445); the (Authz + optimizer) fail-fast moves to #5442
  with the core-enforcement switch; discovery-relocation attribution is
  #5442 only.

Physical deletion of the blocks and the optimizer+authz fail-fast are
out of scope here (deferred to #5445 and #5442 respectively), per the
issue's guard-don't-delete strategy.

Closes #5441

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address review: drop brittle line numbers in test comment

Fixed issues from code review:
- MEDIUM: TestServeOmitsAuthzAndAnnotation's doc comment cited
  server.go:614/:622 for the authz/annotation blocks, but this PR's
  own chain-comment addition shifted those lines (:614 now points at
  the backend-enrichment guard). Refer to the blocks by their
  s.config.AuthzMiddleware != nil guard instead, matching the
  production comments and the "Keep Com... (continued)

67523 of 101636 relevant lines covered (66.44%)

63.74 hits per line

Coverage Regressions

Lines Coverage ∆ File
6
76.15
 -5.5% pkg/secrets/keyring/keyctl_linux.go
3
97.36
 -0.53% pkg/authz/authorizers/cedar/core.go
3
79.02
 -0.73% pkg/transport/proxy/httpsse/http_proxy.go
2
96.47
 0.0% pkg/authserver/storage/memory.go
2
82.29
 -0.21% pkg/vmcp/composer/workflow_engine.go
2
56.68
 -0.18% pkg/workloads/manager.go
Jobs
ID Job ID Ran Files Coverage
1 27304005142.1 751
66.44
 GitHub Action Run
Source Files on build 27304005142