stacklok / toolhive / 33051478376

70%

Build Type

push

github

Committed by web-flow

Commit Message

Negotiate CIMD token endpoint auth method (#6400)

CIMD documents from live clients can declare a preferred token_endpoint_auth_method this server does not support while also publishing a plural token_endpoint_auth_methods_supported list (OpenID Connect RP Metadata Choices 1.0) that includes a method the server does support, and the server rejected the whole document without ever looking at that list.

Add TokenEndpointAuthMethodsSupported to ClientMetadataDocument and negotiate the effective auth method from it before falling back to the prior outright rejection, mirroring the same describes-capability-across-every-AS reading the grant_types/response_types filtering already applies to CIMD documents.

The negotiated set stays the server's own supported constant rather than the AS discovery document's advertised methods, since discovery may legitimately advertise symmetric methods that CIMD documents are never allowed to declare.

The change is a pure widening: no document accepted today becomes rejected, and the existing singular-only rejection test is unchanged.

Signed-off-by: Aleksandr Filippov <71711753+alex-feel@users.noreply.github.com>

Coverage Stats

18 of 18 new or added lines in 1 file covered. (100.0%)

71 existing lines in 7 files now uncovered.

76025 of 109294 relevant lines covered (69.56%)

91.97 hits per line