stacklok / toolhive / 29279422953

68%

Build Type

push

github

Committed by web-flow

Commit Message

Allow HTTP upstream OIDC issuers for in-cluster dev environments (#5787)

* Allow HTTP upstream OIDC issuers for in-cluster dev environments

Adds per-upstream insecure_allow_http to OIDCUpstreamRunConfig and
threads it through to validateDiscoveryDocument / validateEndpointOrigin,
the two remaining enforcement points that previously blocked HTTP even
when the global or per-upstream flag was set.

The fix has two parts:
- OIDCUpstreamRunConfig.InsecureAllowHTTP (new): per-upstream opt-in
  for plain-HTTP upstream issuers, OR'd with the global
  RunConfig.InsecureAllowHTTP in buildOIDCConfig so either level enables
  the relaxation.
- validateDiscoveryDocument / validateEndpointOrigin now accept an
  insecureAllowHTTP parameter and skip the HTTPS-scheme check when true,
  allowing an in-cluster Dex instance served over HTTP to pass discovery
  document validation.

Closes #5776

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Regenerate swagger docs for OIDCUpstreamRunConfig.insecure_allow_http

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Add insecure_allow_http to OAuth2UpstreamRunConfig

Mirrors the same per-upstream opt-in added to OIDCUpstreamRunConfig,
so a single OAuth2 upstream can permit plain-HTTP endpoints without
enabling the global InsecureAllowHTTP flag.

Also regenerates swagger docs for the new field.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

12 of 12 new or added lines in 2 files covered. (100.0%)

88 existing lines in 7 files now uncovered.

73152 of 107722 relevant lines covered (67.91%)

63.62 hits per line