stacklok / toolhive / 39973646734

73%

Build Type

push

github

Committed by web-flow

Commit Message

Fix vMCP incoming OIDC client secret resolution (#6904)

* Fix vMCP incoming OIDC client secret resolution

The incoming OIDC middleware built its TokenValidatorConfig without
ClientSecret, so OIDCConfig.ClientSecretEnv was ignored. The validator
then fell back to TOOLHIVE_OIDC_CLIENT_SECRET, which the operator does
not set for vMCP pods (it injects VMCP_OIDC_CLIENT_SECRET and writes
clientSecretEnv: VMCP_OIDC_CLIENT_SECRET), breaking RFC 7662
introspection for opaque tokens.

Resolve the configured environment variable when building the validator
and fail fast with a clear error if it is set but empty. Reading the
environment here keeps the CLI YAML path and the operator path in sync
and avoids putting the secret into configuration.

Signed-off-by: xianshujun <xianshupang@gmail.com>

* Strengthen OIDC client secret middleware test

Exercise an opaque token through the real middleware and assert that the
introspection endpoint receives the configured client ID and secret. This
covers the ClientSecret wiring added for #6890 instead of only checking
that middleware construction succeeds.

Signed-off-by: xianshujun <xianshupang@gmail.com>

---------

Signed-off-by: xianshujun <xianshupang@gmail.com>

Coverage Stats

22 of 22 new or added lines in 1 file covered. (100.0%)

6 existing lines in 1 file now uncovered.

89379 of 124568 relevant lines covered (71.75%)

127.88 hits per line