stacklok / toolhive / 33742410618

70%

Build Type

push

github

Committed by web-flow

Commit Message

Persist resolved CIMD clients so Redis session rehydration finds them (#6284)

* fix: persist resolved CIMD clients for session rehydration

Redis session rehydration resolves the session's client through the bare
RedisStorage row lookup, never through the CIMD storage decorator, so a
CIMD client that was resolved dynamically at authorize time was not found
at the token endpoint and every exchange failed with a bare
invalid_grant.

Persist the resolved client into the underlying storage on every
successful document fetch (best-effort write-through), marked DCR-issued
so the row carries the same anti-bloat TTL as DCR registrations.
Rehydration then finds the persisted snapshot without a document
re-fetch, so established sessions also survive pod restarts and document
rotation. The rehydration client lookup now also logs the client id and
the wrapped error, which previously left no server-side trace.

Closes #6187

Signed-off-by: Aleksandr Filippov <71711753+alex-feel@users.noreply.github.com>

* fix: address review feedback on CIMD client persistence

Add a rate.Limiter to /oauth/authorize, gating only requests whose
client_id is a CIMD URL, mirroring the existing /oauth/register limiter.
The gate fires before fosite's NewAuthorizeRequest so a flood of distinct
CIMD client_id values cannot mint persisted rows faster than the limit.
DCR (non-URL) client_id values are never gated.

Wrap storage with a new shape-guard decorator whenever CIMD is disabled,
so GetClient refuses any URL-shaped client_id outright instead of
resolving a stale row a prior CIMD-enabled period may have persisted.
Document the resulting lifecycle on Config.CIMDEnabled: a persisted row
outlives the flag being turned off, and re-enabling it before the row's
TTL expires makes that snapshot resolvable again without a fresh fetch.

Correct the RegisterClient doc comment to describe the real upsert
semantics both backends implement, since the write-through path now
depends on re-registra... (continued)

Coverage Stats

41 of 45 new or added lines in 5 files covered. (91.11%)

3 existing lines in 2 files now uncovered.

77257 of 110595 relevant lines covered (69.86%)

91.66 hits per line