stacklok / toolhive / 31791076470
70%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 876
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 70.401% (+0.1%) from 70.261%
31791076470

push

github

web-flow 
Make RFC 8693 delegate clients reachable and usable (#6320)

* Define delegate client configuration

* Register configured delegate clients

* Expose configured token exchange

* Add delegate clients to operator API

* Wire operator delegate clients

* Add delegate client E2E coverage

* Let delegate clients present unrelated self-issued tokens

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Remove orphaned trusted-issuer CRD converter test

TestMakeTrustedIssuerRunConfigs referenced mcpv1beta1.TrustedIssuerConfig
and makeTrustedIssuerRunConfigs, neither of which exist anywhere in
production code -- a leftover from an earlier, superseded draft that
broke the package build on this branch's base commit. Trusted-issuer
CRD mapping was never implemented and is out of scope here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Simplify delegate-client config and harden secret handling

Remove the GrantTypes field from DelegateClientRunConfig/DelegateClient
now that it can only ever hold one legal value, matching the CRD side's
existing no-grant-types precedent -- the constant is now hardcoded where
the client actually gets registered. Replace a hand-rolled contains()
with stdlib slices.Contains. Reject delegate-client secrets under 32
characters, since (unlike DCR-minted secrets) they're operator-supplied
and never otherwise checked for entropy. Warn at startup that a
configured delegate client can exchange any user's self-issued token.
Document the intentional CEL/Go asymmetry around loopback-HTTP delegate
clients, and add a worked example to the token-exchange delegation doc.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix CI: remove dead helper, regenerate swagger docs

golangci-lint flagged unverifiedJWTClaims as unused in the delegate
client e2e test -- it was superseded by verifiedJWTClaims and never
called. Also regenerate docs/server/swagger.{json,yaml} via swag init,
which had drifted from the RunConfig/Dele... (continued)

464 of 548 new or added lines in 18 files covered. (84.67%)

14 existing lines in 7 files now uncovered.

85141 of 120937 relevant lines covered (70.4%)

98.1 hits per line

Uncovered Changes

Lines Coverage ∆ File
18
66.08
 0.17% cmd/thv-operator/controllers/virtualmcpserver_controller.go
15
92.63
 -1.06% cmd/thv-operator/pkg/controllerutil/authserver.go
13
69.46
 0.5% cmd/thv-operator/controllers/mcpremoteproxy_controller.go
8
87.68
 -0.44% pkg/authserver/runner/embeddedauthserver.go
7
45.24
 0.57% cmd/thv-operator/api/v1beta1/zz_generated.deepcopy.go
6
85.92
 -0.02% pkg/authserver/server_impl.go
5
80.47
 -0.46% cmd/thv-operator/controllers/virtualmcpserver_deployment.go
4
96.63
 -0.36% pkg/authserver/config.go
3
69.63
 0.51% cmd/thv-operator/controllers/mcpserver_controller.go
3
91.48
 -0.22% cmd/thv-operator/pkg/vmcpconfig/converter.go
2
89.6
 0.52% pkg/authserver/server/registration/client.go

Coverage Regressions

Lines Coverage ∆ File
3
92.63
 -1.06% cmd/thv-operator/pkg/controllerutil/authserver.go
3
67.14
 -4.29% pkg/state/runconfig.go
2
75.5
 -0.24% pkg/transport/proxy/streamable/streamable_proxy.go
2
82.27
 -0.21% pkg/vmcp/composer/workflow_engine.go
2
66.64
 5.16% pkg/workloads/manager.go
1
66.08
 0.17% cmd/thv-operator/controllers/virtualmcpserver_controller.go
1
87.68
 -0.44% pkg/authserver/runner/embeddedauthserver.go
Jobs
ID Job ID Ran Files Coverage
1 31791076470.1 876
70.4
 GitHub Action Run
Source Files on build 31791076470