1
44%
main: 44%

Ran 11 Feb 2026 09:54PM UTC

Files 667

Run time 24s

Badge

Embed ▾

Committed 11 Feb 2026 09:41PM UTC coverage: 44.075% (+0.01%) from 44.061%

Job # 21924134758.1

Build Type

push

github

Committed by

web-flow

Commit Message

mcp: add UpstreamOAuthClient type and storage for DCR caching (#6107)

## Summary

Add per-instance caching of RFC 7591 Dynamic Client Registration (DCR)
results in the databroker. DCR registers an OAuth client *application*,
not a per-user credential — so Pomerium should register once per (AS
issuer, downstream host) pair and reuse the resulting
`client_id`/`client_secret` for all users.

- New `UpstreamOAuthClient` proto type with fields: issuer,
downstream_host, client_id, client_secret, redirect_uri,
registration_endpoint, created_at
- New `GetUpstreamOAuthClient` / `PutUpstreamOAuthClient` storage
methods keyed by `dcr|{issuer}|{downstream_host}`
- Validation that issuer and downstream_host are non-empty on put

## Related issues

- [ENG-3572: Cache DCR client registrations per-instance in
databroker](https://linear.app/pomerium/issue/ENG-3572/cache-dcr-client-registrations-per-instance-in-databroker)

## User Explanation

No user-facing changes. This is an internal storage addition for a
future feature (upstream MCP OAuth proxying).

## Checklist

- [x] reference any related issues
- [ ] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

32021 of 72651 relevant lines covered (44.08%)

117.85 hits per line

pomerium / pomerium / 21924134758 / 1
44%
main: 44%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21924134758.1

pomerium / pomerium / 21924134758 / 1 44% main: 44%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 21924134758.1

pomerium / pomerium / 21924134758 / 1
44%
main: 44%

README BADGES
x