stacklok / toolhive / 34324393267

71%

Build Type

push

github

Committed by web-flow

Commit Message

Use Basic auth for OAuth2 upstreams (#6543)

Use Basic auth for OAuth2 upstreams (#6536)

Some upstream identity providers require client_secret_basic for confidential clients and reject credentials sent in the token request body. Add token_endpoint_auth_method to OAuth2UpstreamRunConfig, default it to client_secret_basic when a secret is configured, and pass it through buildPureOAuth2Config so the existing authStyleFromMethod selects HTTP Basic while explicit client_secret_post and DCR-negotiated methods remain supported.

Also validates that a confidential method (client_secret_basic/client_secret_post) has an actual secret source configured, and that the resolved secret isn't empty, and exposes the field on the operator's OAuth2UpstreamConfig CRD type so operator-managed upstreams can select client_secret_post instead of always being forced to the client_secret_basic default.

Fixes #6536

Coverage Stats

34 of 34 new or added lines in 3 files covered. (100.0%)

57 existing lines in 5 files now uncovered.

79727 of 113426 relevant lines covered (70.29%)

92.88 hits per line