stacklok / toolhive / 38598043354

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

MemoryStorage stored and returned live fosite Requesters. fosite writes
the session's ExpiresAt map during every token exchange, before the PKCE
check runs, so parallel /oauth/token requests for one authorization code
raced on the same map and killed the process with "fatal error:
concurrent map writes".

Snapshot request fields, form values and sessions on every Create and
Get for authorization codes, access tokens, refresh tokens and PKCE
requests. Reject expired authorization codes on read with a not-found
error so fosite maps them to invalid_grant; the check follows the
invalidated-code check so reuse detection still revokes tokens.

Add storage-level and HTTP token endpoint tests that reproduce the
crash without the fix.

Coverage Stats

46 of 46 new or added lines in 1 file covered. (100.0%)

331 existing lines in 5 files now uncovered.

86683 of 121571 relevant lines covered (71.3%)

126.63 hits per line