stacklok / toolhive / 39565128589

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add auth server TLS listener and SPIFFE middleware (#6843)

SPIFFE X.509-SVID client authentication needs the client certificate
from a TLS handshake, but the MCP proxy port serves plain HTTP. Give
the embedded authorization server its own TLS listener on port 8443,
so the token endpoint can see client certificates without moving MCP
traffic to HTTPS.

The listener requests client certificates only when spiffe_x509 is
configured, sends the SPIFFE CAs as a hint, and reloads the serving
certificate when its files change, keeping the last good pair.
spiffeauth.Middleware extracts a claimed SPIFFE ID from the presented
peer certificate into the request context; it does not verify the
certificate. Malformed SPIFFE identities receive an OAuth JSON error.
Credential validation remains the responsibility of the client
authentication strategy.

EmbeddedAuthServer gains Start, and the proxy runner starts the
listener on the same host as the MCP port, rejecting a proxy or
diagnostics port that collides with it. Constructors reject configured
TLS listeners without a listener host so unsupported callers fail
explicitly. Graceful shutdown force-closes connections on timeout.

SPIFFE trust configuration remains rejected at startup; this change
does not yet enable SPIFFE client authentication.

Co-authored-by: Mecatl <noreply@mecatl.dev>

Coverage Stats

265 of 315 new or added lines in 6 files covered. (84.13%)

61 existing lines in 4 files now uncovered.

88365 of 123666 relevant lines covered (71.45%)

127.06 hits per line