stacklok / toolhive / 27709408218

67%

Build Type

push

github

Committed by web-flow

Commit Message

Accept 401/403 in runner readiness probe when auth configured (#5554)

* Accept 401/403 in runner readiness probe

The MCP readiness probe (waitForInitializeSuccess) sends an
unauthenticated request to ToolHive's own local proxy and accepted
only HTTP 200. When a workload has OIDC configured, the auth
middleware rejects the tokenless probe with 401, so the probe
retried until the full 5-minute timeout, delaying startup and
logging a misleading failure.

Pass an authExpected signal (derived from OIDCConfig) into the probe
and treat 401/403 as ready when auth is expected: those responses
prove the proxy listener is up and enforcing credentials. When no
auth is configured, behavior is unchanged.

Closes #5553

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add isReadyStatus table test and clarify probe docs

Address PR review feedback:
- Add table-driven TestIsReadyStatus over {200,401,403,500} x
  {auth,no-auth}. The 500-with-auth case pins the contract so a
  regression loosening the check to "any non-200 when auth expected"
  fails. Drop the now-redundant 403 and no-auth-401 timeout subtests.
- Document that under OIDC the probe reflects only the proxy/auth
  layer, not backend initialization.
- Note that 403 is accepted defensively; no current ToolHive path
  emits it for the probe (the validator returns 401).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

9 of 14 new or added lines in 1 file covered. (64.29%)

4 existing lines in 2 files now uncovered.

69056 of 103039 relevant lines covered (67.02%)

62.18 hits per line