stacklok / toolhive / 33383317159

70%

Build Type

push

github

Committed by web-flow

Commit Message

Intersect default scopes with scopes_supported when scope is omitted (#6283)

* fix: intersect default scopes with scopes_supported

When a registration omits scope, ValidateScopes required every entry of
DefaultScopes to be present in scopes_supported and rejected the client
otherwise, so any server whose scopes_supported lacks even one default
(e.g. profile) rejected every scope-less registration with a generic
invalid_client, on both the DCR and the CIMD registration paths.

Fall back to the intersection of DefaultScopes with scopes_supported
instead, and report the dropped defaults so both callers WARN-log them
with the client identity. An empty intersection is still rejected, with
an error description that names the full default set. CIMD rejection
paths now also WARN-log the client_id and the reason, which previously
left no server-side trace at any level.

Closes #6186

Signed-off-by: Aleksandr Filippov <71711753+alex-feel@users.noreply.github.com>

* fix: address review feedback on omitted-scope logging

Demote the per-registration dropped-defaults record to Debug and move
it after the baseline union: on the DCR path it rides the existing
'registered new DCR client' record keyed on client_id, on the CIMD
path it logs the final post-union scope set. The drop is a pure
function of startup configuration, so the operator-facing signal is
now a one-time startup log in Config.applyDefaults (Info when the
intersection narrows the default set, Warn when it is empty and
scope-omitting clients will be rejected), reusing ValidateScopes so
the startup message cannot drift from request-path behavior.

Name the residual gap in ValidateScopes: the omitted-scope fallback
draws from DefaultScopes only, so entries in scopes_supported outside
the default set remain unreachable on that path; the explicit opt-in
is baseline_client_scopes = scopes_supported.

Update the stale BaselineClientScopes doc comments that described the
pre-intersection fallback and regener... (continued)

Coverage Stats

71 of 75 new or added lines in 4 files covered. (94.67%)

69 existing lines in 7 files now uncovered.

76373 of 109635 relevant lines covered (69.66%)

91.69 hits per line