stacklok / toolhive / 38740679061

71%

Build Type

push

github

Committed by web-flow

Commit Message

Re-register DCR clients the upstream evicted (#6822)

* Re-register DCR clients the upstream evicted

A cached DCR registration was reused forever, but a ToolHive auth
server evicts idle DCR clients after DefaultDCRClientTTL while
advertising client_secret_expires_at=0. Once evicted, every
authorization was rejected upstream with invalid_client and nothing
recovered.

On a cache hit the resolver now redeems a random authorization code
at the token endpoint with the cached credentials. invalid_client
means the registration is gone, so it registers a new client and
replaces the stale row through UpdateDCRCredentialsIfUnchanged.
invalid_grant or any inconclusive answer keeps the cached client.

Fixes #6821

Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Clarify when the DCR registration probe decides

Only servers that authenticate the client before validating the grant
answer invalid_client for a deleted registration. For public clients
some servers validate the code first, and the probe then keeps the
cached registration as before.

Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Make DCR registration replacement an optional store capability

Adding ReplaceIfUnchanged to dcr.CredentialStore broke every store
implemented outside this package, and a wrapper that embeds the
interface would have inherited the method silently, so a replacement
would bypass whatever the wrapper does around writes. Move it to a
separate Replacer interface that both in-package stores implement. The
resolver checks for it before probing: a store that cannot act on a
rejection keeps today's cache-hit behaviour and the upstream is not
contacted at all.

Read the cache inside the singleflight, so a caller can no longer
revalidate a row it read before an earlier flight for the same key
replaced it and register a second client. The recheck in
registerAndCa... (continued)

Coverage Stats

143 of 163 new or added lines in 3 files covered. (87.73%)

56 existing lines in 4 files now uncovered.

86875 of 121841 relevant lines covered (71.3%)

126.8 hits per line