stacklok / toolhive / 31706784393

70%

Build Type

push

github

Committed by web-flow

Commit Message

Ignore unsupported grant types in CIMD documents (#6297)

* Ignore unsupported grant types in CIMD documents

A Client ID Metadata Document describes the client's capabilities
across every authorization server it talks to, and the client cannot
tailor it per server. VS Code declares the device_code grant alongside
authorization_code, and the CIMD resolver rejected the whole document
over it, surfacing as an opaque invalid_client at /oauth/authorize.

Filter unsupported grant_types and response_types out of CIMD documents
instead of rejecting them, while still rejecting documents whose
supported set does not intersect the one flow this server offers
(authorization_code / code) — such a client could never complete a
token exchange, and a clear error at resolution beats failing every
token request. The stored fosite client carries only the filtered
types, and dropped entries are logged at Debug for diagnosability.

DCR requests keep the strict validation: unlike a CIMD document, a
registration request is addressed to this server specifically, so
rejecting an unsupported grant type is correct feedback there.

Fixes #6290

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Clone filter defaults and simplify drop-log condition

Review follow-ups: the filters returned the package-level default
slices unaliased into cached fosite clients (inconsistent with the
scope path, which clones), and the drop-log condition bound a value
it only compared against zero.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

49 of 49 new or added lines in 2 files covered. (100.0%)

18 existing lines in 5 files now uncovered.

84681 of 120413 relevant lines covered (70.33%)

99.28 hits per line