stacklok / toolhive / 40708795032

73%

Build Type

push

github

Committed by web-flow

Commit Message

Re-check upstream DCR registrations while running (#6948)

The embedded auth server resolves an upstream's DCR registration once, at
start. A registration the upstream drops afterwards stays in use until the
process restarts, so every sign-in in between fails at the upstream, and a
replica that started earlier keeps a registration a later replica replaced
(#6496).

dcrConfig.registrationProbeInterval (a duration of at least 1m, empty by
default) repeats the start-time resolution on that interval. Each tick
re-reads the stored row, checks it with the configured registrationProbe,
replaces a rejected registration, registers a missing one, and switches the
running upstream provider to the result when it names a different client,
including a row another replica replaced. Endpoints the run config left to
discovery follow the new registration, and a file-based initial access
token is re-read on every tick. The first tick waits a random part of the
interval and later ones the interval +-10%, so replicas of one rollout do
not probe and re-register together.

A provider holds its client config and, for OIDC, the ID token verifier as
one state behind an atomic pointer; a token request and the ID token check
that follows it use the state they loaded, so a swap during the request does
not fail it. A failed tick is logged and leaves the provider on its current
client; a switch is logged at Warn because authorizations started under the
previous client may fail their code exchange. Periodic ticks log the 90-day
staleness warning at Debug.

Signed-off-by: Aron Gates <aron@muonspace.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Coverage Stats

235 of 262 new or added lines in 11 files covered. (89.69%)

2 existing lines in 2 files now uncovered.

90279 of 125416 relevant lines covered (71.98%)

129.71 hits per line