stacklok / toolhive / 38710011267

71%

Build Type

push

github

Committed by web-flow

Commit Message

Add dcrConfig.rotationKey to re-register upstream DCR clients (#6825)

Add rotationKey for upstream DCR re-registration

An embedded auth server resolves its upstream RFC 7591 registration once
per process start and then serves the cached client_id from the credential
store forever: the only invalidation is client_secret_expires_at, which
public-client upstreams never send. When the upstream drops the
registration, the rejection surfaces only in the user's browser, the proxy
keeps presenting the dead client_id on every start, and the sole remedy is
deleting the Redis row by hand and restarting.

Add dcrConfig.rotationKey, an optional operator-chosen label that is folded
into the DCR cache identity (DCRKey, the Redis key, the persisted row, the
memory map key and the singleflight key) only when non-empty and is never
sent to the upstream. Bumping it makes the next start register a fresh
client; an empty value addresses exactly the pre-existing key, so existing
rows need no migration. The run-config validates the same alphabet and
length the CRD markers enforce, and the cache-hit and registration logs
carry the key so operators can confirm which generation a replica runs.

Related to #6821 (automatic recovery), #6496, #6508.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Coverage Stats

20 of 20 new or added lines in 6 files covered. (100.0%)

20 existing lines in 3 files now uncovered.

86691 of 121590 relevant lines covered (71.3%)

126.65 hits per line