1
66%
main: 66%

Ran 13 Mar 2026 08:09AM UTC

Files 554

Run time 12s

Badge

Embed ▾

Committed 13 Mar 2026 08:04AM UTC coverage: 64.367% (-0.06%) from 64.424%

Job # 23041807322.1

Build Type

push

github

Committed by

web-flow

Commit Message

fix(vmcp): apply outgoing auth credentials during health checks (#4101) (#4118)

Health check probes were sent unauthenticated to backend MCPServers
because both auth strategies short-circuited on the health-check context
marker before injecting any credentials.

HeaderInjectionStrategy: remove the early return — static headers have no
dependency on user identity and must be injected for all requests,
including probes.

TokenExchangeStrategy: instead of a blanket skip, perform an OAuth2
client_credentials grant when client_id + client_secret are configured,
so the health probe carries a valid Bearer token. When credentials are
not configured the probe is still sent unauthenticated (unchanged
behaviour for that case).

Unit tests are updated / added to cover both the fixed header-injection
path and the two token-exchange health-check branches (with and without
client credentials). E2E tests are added in
test/e2e/thv-operator/virtualmcp for both auth strategies, including a
new DeployMockOAuth2ServerWithNodePort helper that lets the test assert
client_credentials grants were actually made to the token endpoint.

Closes: #4101

Co-authored-by: taskbot <taskbot@users.noreply.github.com>

Coverage Stats

48477 of 75314 relevant lines covered (64.37%)

72.91 hits per line

stacklok / toolhive / 23041807322 / 1
66%
main: 66%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 23041807322.1

stacklok / toolhive / 23041807322 / 1 66% main: 66%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 23041807322.1

stacklok / toolhive / 23041807322 / 1
66%
main: 66%

README BADGES
x