stacklok / toolhive / 29618549899

69%

Build Type

push

github

Committed by web-flow

Commit Message

Respect DCR-negotiated token endpoint auth method (#5866)

* Respect DCR-negotiated token endpoint auth method

The upstream OAuth2 client hardcoded AuthStyleInParams
(client_secret_post) at the token endpoint, ignoring the
token_endpoint_auth_method negotiated during Dynamic Client
Registration. Authorization servers that register confidential
clients as client_secret_basic (e.g. Ory Hydra's default) reject
the code exchange with invalid_client, leaving the integrator no
workaround since the method is a property of the upstream's
registration response.

Thread the negotiated method through to the token exchange:

- Add TokenEndpointAuthMethod to upstream.OAuth2Config and map it
  to oauth2.AuthStyle in newBaseOAuth2Provider (basic -> header,
  post/unset -> body), preserving existing behavior for statically
  configured upstreams.
- Copy dcr.Resolution.TokenEndpointAuthMethod through
  applyResolutionToOAuth2Config so DCR-registered clients present
  credentials the way the upstream expects.
- Add client_secret_basic/client_secret_post constants to oauthproto.

Fixes #5865

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Fail loudly on unsupported token endpoint auth method

Addresses stacklok/toolhive#5866 review comments:
- MEDIUM pkg/authserver/upstream/oauth2.go (3605835893): reject an
  unrecognised non-empty token_endpoint_auth_method (e.g.
  private_key_jwt, which the DCR resolver ranks first) at construction
  instead of silently degrading to POST-body credentials, per the
  fail-loudly-on-unknown-enum convention. Recognised methods
  (basic/post/none) and unset are unchanged.
- INFO pkg/authserver/upstream/oauth2.go (3605835902): document that
  statically-configured upstreams have no path to set the field.
- LOW pkg/authserver/runner/dcr_adapter.go (3605835908): note the
  negotiated auth method (not just the secret) is dropped when the
  paired call is skipped.
- LOW pkg/authserver/upstream/oauth2.go (3605835911): centralise the... (continued)

Coverage Stats

14 of 14 new or added lines in 2 files covered. (100.0%)

10 existing lines in 4 files now uncovered.

75064 of 109435 relevant lines covered (68.59%)

71.63 hits per line