feat: add authorizationEndpointBaseUrl override to embedded auth server#4396
Merged
feat: add authorizationEndpointBaseUrl override to embedded auth server#4396
Conversation
Allow the browser-facing authorization endpoint in the OAuth discovery document to be served from a different host than the issuer. When the new optional field is set, only authorization_endpoint changes; all other endpoints (token, registration, JWKS) remain derived from issuer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract parameterized test helper to eliminate ~70 lines of duplicated setup code in the new discovery handler override tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4396 +/- ##
=======================================
Coverage 69.47% 69.47%
=======================================
Files 485 485
Lines 49805 49825 +20
=======================================
+ Hits 34603 34618 +15
- Misses 12523 12530 +7
+ Partials 2679 2677 -2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an optional authorizationEndpointBaseUrl override that changes only the advertised authorization_endpoint in the OAuth/OIDC discovery documents, enabling browser-facing auth to live on a different host than the issuer used for backend flows.
Changes:
- Introduces
AuthorizationEndpointBaseURLacross CRD → operator conversion → runner/config → OAuth server params/config. - Updates discovery document generation to derive
authorization_endpointfromGetAuthorizationEndpointBaseURL()(issuer fallback). - Adds unit tests for helper fallback/override behavior and for discovery document override behavior.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/authserver/server_impl.go | Plumbs AuthorizationEndpointBaseURL into AuthorizationServerParams. |
| pkg/authserver/server/provider.go | Adds field + validation + helper (GetAuthorizationEndpointBaseURL) on server config. |
| pkg/authserver/server/provider_test.go | Adds tests for helper behavior and invalid override validation. |
| pkg/authserver/server/handlers/discovery.go | Uses GetAuthorizationEndpointBaseURL() when constructing authorization_endpoint. |
| pkg/authserver/server/handlers/handlers_test.go | Extends handler test setup and adds discovery override tests for OAuth + OIDC endpoints. |
| pkg/authserver/runner/embeddedauthserver.go | Propagates RunConfig field into resolved authserver.Config. |
| pkg/authserver/config.go | Adds AuthorizationEndpointBaseURL to RunConfig + Config and validates it. |
| pkg/authserver/config_test.go | Adds validation test cases for authorization_endpoint_base_url. |
| cmd/thv-operator/pkg/controllerutil/authserver.go | Copies CRD field into authserver.RunConfig. |
| cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.go | Adds optional CRD field with pattern validation and documentation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Extract validateTokenLifespans and validateParams to reduce cyclomatic complexity in NewAuthorizationServerConfig. Regenerate CRD docs, swagger, and helm docs to include the new authorizationEndpointBaseUrl field. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jhrozek
approved these changes
Mar 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
authorizationEndpointBaseUrlfield toEmbeddedAuthServerConfigthat overrides only theauthorization_endpointin the OAuth discovery document{authorizationEndpointBaseUrl}/oauth/authorizeinstead of{issuer}/oauth/authorize; all other endpoints (token, registration, JWKS) remain derived from issuerChanges (7 source files + tests)
EmbeddedAuthServerConfigwith same validation pattern asIssuervalidateIssuerURLGetAuthorizationEndpointBaseURL()helper with issuer fallback, validationGetAuthorizationEndpointBaseURL()forauthorization_endpointWhat does NOT change
token_endpoint,registration_endpoint,jwks_uri— still derived from issuerRedirectURI— already independently configurablefosite.Config.AccessTokenIssuer— stays as issuer (for JWTissclaims)Test plan
go build ./...passesgo test ./pkg/authserver/...— all existing + new tests pass🤖 Generated with Claude Code