stacklok / toolhive / 40754094680

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add configured delegate client metadata (#6952)

Delegate clients could only be secret-authenticated, token-exchange-only
clients. Issue #6893 needs a pre-provisioned broker that keeps its
client_id across key rotation, so the config now accepts an auth method,
a JWKS file, grant types and redirect URIs.

One validator in the registration package checks these fields and shares
the DCR private_key_jwt key check. It runs on RunConfig (keys not yet
loaded), on the resolved Config (keys loaded) before any client is
registered, and when the client is built. Redirect URIs follow the
confidential-client rule: https, not loopback. refresh_token requires
authorization_code, as in DCR. The constructor keeps today's bare client
for default inputs and never marks the result as DCR-issued.

Every delegate client still counts as confidential for the
cleartext-transport check, private_key_jwt ones included. They send no
reusable secret, but unlike token-exchange-only DCR private_key_jwt
clients they can hold authorization_code and refresh_token, so codes and
tokens would cross plain HTTP. This matches the CRD rules and can be
relaxed later if an in-cluster HTTP issuer is needed. The transport
errors now name both triggers instead of only confidential registration.

Replacing a configured client now also logs the WARN from #6918 when its
grant types, redirect URIs or auth method change. A JWKS change is key
rotation and stays silent.

The runner does not load the JWKS file or pass the new fields yet; the
next change in the stack wires them, and the two are meant to land
together.

Co-authored-by: Mecatl <noreply@mecatl.dev>

Coverage Stats

228 of 230 new or added lines in 9 files covered. (99.13%)

1 existing line in 1 file now uncovered.

90526 of 125714 relevant lines covered (72.01%)

130.49 hits per line