32367940622
70%

Ran 20 Aug 2026 12:22PM UTC

Jobs 1

Files 886

Run time 2min

Badge

Embed ▾

Committed 20 Aug 2026 12:15PM UTC coverage: 69.232% (+0.01%) from 69.22%

Build # 32367940622

Build Type

push

github

Committed by

web-flow

Commit Message

Add JWT-bearer assertion grant (#6391)

Allow trusted external issuers to exchange signed RFC 7523 assertions directly for bounded ToolHive access tokens, without a registered OAuth client.

Validate the issuer, signature, authorization-server audience, assertion age, and exact subject/resource binding. Consume each assertion before issuance to prevent replay, including assertions without a jti claim. Use a synthetic client only to keep the clientless request persistence-safe.

Expose issuer policy through MCPExternalAuthConfig, share trusted-issuer validation with RFC 8693 token exchange, and advertise the grant only when configured.

Fixes #6336
Fixes #6337

Coverage Stats

462 of 642 new or added lines in 17 files covered. (71.96%)

12 existing lines in 3 files now uncovered.

74295 of 107313 relevant lines covered (69.23%)

88.44 hits per line

Uncovered Changes

Lines	Coverage	∆	File
49	81.44		pkg/authserver/server/tokenexchange/jwt_bearer_handler.go
40	44.6	-0.77%	cmd/thv-operator/api/v1beta1/zz_generated.deepcopy.go
39	88.2	-5.26%	pkg/authserver/server/tokenexchange/multi_issuer_validator.go
14	56.42	-1.37%	pkg/authserver/storage/mocks/mock_storage.go
11	74.09	-3.47%	cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go
8	95.42	-0.86%	pkg/authserver/storage/memory.go
5	83.32	0.1%	pkg/authserver/storage/redis.go
4	95.52	-0.81%	pkg/authserver/config.go
4	82.46	-3.59%	pkg/authserver/server/tokenexchange/factory.go
4	84.03	-0.14%	pkg/authserver/server_impl.go
2	86.55	-0.31%	pkg/authserver/runner/embeddedauthserver.go

Coverage Regressions

Lines	Coverage	∆	File
6	19.87	-3.97%	pkg/client/manager.go
4	59.21	-0.1%	pkg/workloads/manager.go
2	87.5	-6.25%	pkg/vmcp/backendregistry/registry.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	32367940622.1	20 Aug 2026 12:22PM UTC	886	69.23	GitHub Action Run

stacklok / toolhive / 32367940622
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 32367940622

stacklok / toolhive / 32367940622 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 32367940622

stacklok / toolhive / 32367940622
70%

README BADGES
x