pomerium / pomerium / 34297129288

53%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: keep ext_proc databroker access working across outbound connection reloads (#6740)

## Summary

The MCP ext_proc handler captured a databroker connection from the
controlplane's shared outbound connection cache once at startup. Any
later reload of that cache, triggered by the first stored
identity-manager error after the config gained databroker-delivered
settings, closed the captured connection and every upstream-token lookup
failed with `Canceled`, so the handler answered 502 until restart.

The handler now owns its outbound connection and rebuilds its databroker
client from every config change, and its storage resolves the client on
each use. `mcp.New` and the ext_proc constructor take a client getter;
proxy and authorize supply one backed by their current state, and the
ext_proc handler is built through a single constructor.

## Related issues

- #6730

## User Explanation

MCP routes no longer return 502 permanently after an outbound gRPC
connection reload. Restarting Pomerium is no longer required to recover.

## AI disclosure

Claude Code. The maintainer directed the refactor; Claude Code
implemented it and wrote the tests.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`bug`)
- [x] disclosed AI usage
- [ ] ready for review

Coverage Stats

71 of 90 new or added lines in 6 files covered. (78.89%)

13 existing lines in 6 files now uncovered.

33658 of 63829 relevant lines covered (52.73%)

351.7 hits per line