stacklok / toolhive / 40898763317

73%

Build Type

push

github

Committed by web-flow

Commit Message

Wire configured delegate clients into the runner (#6953)

* Share embedded auth server test helper

The delegate client integration tests each repeated the code that starts
an embedded auth server on a loopback listener with a mock upstream and
registers its cleanup. Move it into one helper that takes a config
callback and optional storage, and make the runner and restart tests thin
wrappers over it. Their behaviour is unchanged, except that the restart
test's 30-second construction timeout now applies to every caller.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Wire configured client auth fields into runner

The configured delegate client fields were validated but never reached
the running server. The runner now reads each jwks_file next to the
client secret handling and passes keys, auth method, grants and
redirect URIs to the client constructor. A jwks_file with more than one
key must give every key a unique kid, and the client must send the kid
of its signing key: fosite checks an assertion without a kid only
against the first signing key of its type, so a key added during a
rotation could not be used otherwise.

Discovery advertises private_key_jwt when a configured client uses it,
and the client_secret_* methods only when confidential DCR is on or a
configured client authenticates with a secret. The cleartext-transport
rule is unchanged: every delegate client, private_key_jwt ones
included, still counts as confidential there.

With grant_types wired through, a configured client can hold grants
other than token exchange and still lack authorization_code. /authorize
now treats every client without authorization_code as back-channel
only and answers invalid_client, as for an unknown client, so the
client's existence cannot be probed. It deliberately does not use
unauthorized_client (RFC 6749 section 4.1.2.1) for the same reason.

Delegate clients are built and checked as consent-exempt before they
are written, and the built delegate wins over a... (continued)

Coverage Stats

128 of 131 new or added lines in 10 files covered. (97.71%)

322 existing lines in 4 files now uncovered.

90779 of 125990 relevant lines covered (72.05%)

130.78 hits per line