stacklok / toolhive / 28198129566

67%

Build Type

push

github

Committed by web-flow

Commit Message

Add vMCP OBO strategy seam (OBOConfig field + stub + override hook) (#5624)

* Add vMCP OBO strategy seam (OBOConfig field + stub + override hook)

Implements changes for issue #5623:
- Add OBOConfig struct and OBO field to BackendAuthStrategy in
  pkg/vmcp/auth/types, giving the enterprise OBO converter a typed
  carrier for token URL, clientID, audience, scopes, client-secret,
  subject-provider-name, and cache-skew-seconds
- Update zz_generated.deepcopy.go for the new OBOConfig type
- Add oboStrategyStub + RegisterOBOStrategy hook in pkg/vmcp/auth,
  mirroring the obo.RegisterFactory and controllerutil.RegisterOBOHandler
  patterns; default stub returns obo.ErrEnterpriseRequired from every
  method — consistent with the other three dispatch points
- Register the OBO strategy in factory.NewOutgoingAuthRegistry so
  GetStrategy("obo") resolves with a uniform ErrEnterpriseRequired
  result instead of a generic not-found error
- Regenerate CRD API reference docs for the new OBOConfig type

* Wire OBO into vmcp config validator and yaml_loader

Addresses stacklok/toolhive#5624 review comments:
- HIGH pkg/vmcp/config/validator.go (F1): Add StrategyTypeOBO to the
  validTypes slice and a case branch that nil-guards OBO config and
  requires tokenUrl, matching the pattern of the other strategy types
- MEDIUM pkg/vmcp/config/yaml_loader.go (F4): Add a StrategyTypeOBO
  case to processBackendAuthStrategy that resolves ClientSecretEnv ->
  ClientSecret at load time, mirroring the token_exchange case

* Fix test issues flagged in PR review

Addresses stacklok/toolhive#5624 review comments:
- MEDIUM obo_test.go (F14): Remove t.Parallel() from
  TestNewOBOStrategy_DefaultReturnsStub; it reads shared
  currentOBOStrategyFactory and must not race serial tests that mutate it
- MEDIUM factory/outgoing_test.go (F11): Add Authenticate call to the OBO
  sub-test so the hot path is also verified to return ErrEnterpriseRequired
- LOW obo_test.go (F12): Use req.Context() ... (continued)

Coverage Stats

44 of 77 new or added lines in 5 files covered. (57.14%)

76 existing lines in 6 files now uncovered.

69514 of 103225 relevant lines covered (67.34%)

65.02 hits per line