stacklok / toolhive / 27790954246

67%

Build Type

push

github

Committed by web-flow

Commit Message

Add MCPAuthzConfig ref-resolution foundation (#5559)

* Add MCPAuthzConfig ref-resolution foundation

Foundation (Stage 1 of #4778's re-derivation) for making spec.authzConfigRef
enforce at runtime. Purely additive: no workload controller is wired yet and
the inline spec.authzConfig path is untouched.

- Add controllerutil ref-helpers in authz_ref.go: GetAuthzConfigForWorkload,
  ValidateAuthzConfigReady, AddAuthzConfigRefOptions (resolves a referenced
  MCPAuthzConfig into a runner authz.Config for any registered backend —
  cedarv1 and httpv1 — via the authorizers factory), and the
  EnsureAuthzConfigMapFromRef / GenerateAuthzVolumeConfigFromRef materialization
  helpers mirroring the inline ones.
- Export and move BuildFullAuthzConfigJSON from the MCPAuthzConfig controller
  into controllerutil so both the config controller and the workload controllers
  share it without an import cycle; the controller now calls the shared helper.
- Add the AuthzConfigHash status field to MCPServer, MCPRemoteProxy, and
  VirtualMCPServer, plus ConditionAuthzConfigRefValidated and reason constants,
  mirroring the OIDCConfigRef equivalents.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Regenerate CRD manifests and docs for AuthzConfigHash

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address review feedback on authz ref helpers

- Guard EnsureAuthzConfigMapFromRef with ValidateAuthzConfigReady so the
  exported helper never materializes a ConfigMap from a config flagged invalid
  (defense in depth; no extra I/O — the object is already fetched). (F2)
- Clarify the authzRefConfigMapName doc comment: the ConfigMap *name* is
  distinct from the inline path, while the *volume* name and mount path are
  deliberately shared (inline and ref are mutually exclusive via CRD
  XValidation, so a workload mounts at most one authz volume). (F3)
- Restore the nil data/factory assertions on BuildFullAuthzConfigJSON's error
  bran... (continued)

Coverage Stats

102 of 125 new or added lines in 2 files covered. (81.6%)

15 existing lines in 4 files now uncovered.

69507 of 103475 relevant lines covered (67.17%)

63.69 hits per line