Add upstream_inject strategy type and auth server validation#4349
Merged
Add upstream_inject strategy type and auth server validation#4349
Conversation
4 tasks
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4349 +/- ##
==========================================
+ Coverage 68.45% 69.55% +1.09%
==========================================
Files 479 480 +1
Lines 48642 48722 +80
==========================================
+ Hits 33300 33890 +590
+ Misses 12373 12221 -152
+ Partials 2969 2611 -358 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
tgrunnagle
reviewed
Mar 24, 2026
afc069c to
0bd1c80
Compare
Add StrategyTypeUpstreamInject and UpstreamInjectConfig to backend auth strategy types, enabling vMCP backends to inject upstream IDP tokens obtained by the embedded authorization server. Add ValidateAuthServerIntegration with cross-cutting validation rules between the embedded auth server config and backend auth strategies: - V-01: upstream_inject requires auth server - V-02: upstream_inject providerName must exist in upstreams - V-04: auth server issuer must match incomingAuth OIDC issuer - V-05: auth server requires issuer and at least one upstream - V-07: incomingAuth audience must be in allowed audiences - V-09: auth server requires OIDC incoming auth - V-10: warn on duplicate upstream_inject provider names - V-11: warn when token_exchange targets the auth server - V-13: AllowedAudiences required for MCP compliance Refs: #4142
d447384 to
39a9a1e
Compare
Contributor
Author
|
I apologize @tgrunnagle I shouldn't have opened the PR before I went through it carefully myself - that was unfiltered CC output that I just gave a cursory look to. I reviewed the patch manually this time and re-did it. I'm marking it ready for review. |
Remove extra blank line and trailing newline that caused the gci linter to fail in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tgrunnagle
previously approved these changes
Mar 24, 2026
Contributor
tgrunnagle
left a comment
There was a problem hiding this comment.
Just a couple non-blocking comments
jerm-dro
previously approved these changes
Mar 24, 2026
Contributor
jerm-dro
left a comment
There was a problem hiding this comment.
Clean design — keeping (Config, RunConfig) as separate parameters is the right call. Validation rules are thorough and well-tested. The slices.Contains cleanup is a nice bonus.
Expand the doc comment on validateAuthServerIncomingAuthConsistency to explain that it applies regardless of outgoing backend strategy (upstream_inject, token_exchange, etc.) and why the issuer/audience match matters: the OIDC middleware rejects every token whose iss claim differs from what it expects. Addresses PR review feedback from @tgrunnagle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Multiple backends referencing the same upstream provider is a valid and expected configuration (e.g., two GitHub-related backends both needing the "github" upstream token). The "likely a copy-paste error" warning was a false positive for legitimate configs. Addresses PR review feedback from @tgrunnagle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Extract the synthetic map key for the default outgoing auth strategy into a named constant. Use "<default-strategy>" instead of "(default)" to clearly distinguish it from authserver.DefaultUpstreamName and prevent key collisions with user-defined backend names. Addresses PR review feedback from @tgrunnagle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both validateAuthServerRequiresOIDC and hasAuthServerWithOIDCIncoming checked the same three-field condition. Extract a shared hasOIDCIncoming predicate so the logic lives in one place. Addresses PR review feedback from @tgrunnagle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
Author
|
the additional commits address each of @tgrunnagle comments, patch per comment for easier review. the original patch is unchanged. |
…ectly Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tgrunnagle
approved these changes
Mar 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
upstream_injectstrategy type.StrategyTypeUpstreamInjectandUpstreamInjectConfigto backend auth strategy types.ValidateAuthServerIntegration(cfg *Config, rc *authserver.RunConfig)with cross-cutting validation rules V-01 through V-07 (issuer consistency, audience matching, provider existence, etc.).*Configand*authserver.RunConfigas separate arguments — noRuntimeConfigwrapper type needed.Fixes #4142
Fixes #4144
Type of change
Test plan
task test)task lint-fix)Special notes for reviewers
Draft — stacked on #4348. Review the incremental diff only.
The validation functions accept
(*Config, *RunConfig)as separate parameters rather than a combinedRuntimeConfigtype. This keeps the config package free of auth server dependencies and makes the function signatures explicit about what they inspect.Generated with Claude Code