issue-link js-issue-link" data-error-text="Failed to load title" data-id="4359410369" data-permission-text="Title is private" data-url="https://github.com/stacklok/toolhive/issues/5145" data-hovercard-type="issue" data-hovercard-url="/stacklok/toolhive/issues/5145/hovercard" href="https://github.com/stacklok/toolhive/issues/5145">#5145. Creates the shared pkg/auth/dcr package and migrates the embedded authserver to consume it. The CLI flow migration (pkg/auth/discovery::PerformOAuthFlow) is left to sub-issue 4b (#5219) so this slice stays under the project's PR-size limit. Files moved (renamed via git mv so the diff shows as renames, not deletions + additions): pkg/authserver/runner/dcr.go -> pkg/auth/dcr/resolver.go pkg/authserver/runner/dcr_store.go -> pkg/auth/dcr/store.go pkg/authserver/runner/dcr_test.go -> pkg/auth/dcr/resolver_test.go pkg/authserver/runner/dcr_store_test.go -> pkg/auth/dcr/store_test.go pkg/authserver/runner/dcr_testhelpers_test.go -> pkg/auth/dcr/testhelpers_test.go Public API surface (renamed from runner-package internals because they now cross a package boundary): Resolution (was DCRResolution) Key (was DCRKey, alias to storage.DCRKey unchanged) CredentialStore (was the package-private dcrResolutionCache) ResolveCredentials (was resolveDCRCredentials) NeedsDCR (was needsDCR) ConsumeResolution (was consumeResolution) ApplyResolutionToOAuth2Config (was applyResolutionToOAuth2Config) LogStepError (was logDCRStepError) NewInMemoryStore (new convenience constructor wrapping storage.NewMemoryStorage; mirrors the pattern the per-test newMemoryDCRStore helpers use) NewStorageBackedStore (was the package-private newStorageBackedStore) SanitizeErrorForLog (was sanitizeErrorForLog; promoted to exported because the deferred-cleanup log path in pkg/authserver/runner needs it) Names follow the pkg/auth/dcr.* form so the linter's stuttering check (revive: dcr.DCRResolution would stutter) passes and the surface reads as ordinary package API. resolveSecret was duplicated into the dcr package because pkg/auth/dcr must stay profile-agnostic and cannot reach back into pkg/authserver/runner. The duplication is intentional and called out in a comment; future consolidation can move it into a shared helper if a third caller appears. A parallel TestResolveSecret / TestResolveSecretWithEnvVar suite in pkg/auth/dcr/secret_test.go mirrors the runner-package twin's observable contract so any future drift between the two copies fails CI on at least one side. Review-feedback bits applied alongside the move: - Package doc comment in pkg/auth/dcr/resolver.go now documents the process-global singleflight in a Concurrency section, and labels the profile-agnostic framing as a target state for sub-issue 4b rather than as a description of the current API shape (the package's public API still takes embedded-authserver types). - dcrFlight var doc gains a cross-consumer caveat naming the "third consumer with colliding redirect URI" failure mode. - Flight-key construction extracted into flightKeyOf(Key) string so the canonical key shape is inspectable rather than buried in a string-concatenation literal. - endpointsFromMetadata gains a defensive nil check; the function's doc comment names the oauthproto contract being defended. - newMemoryDCRStore test helper is duplicated across the two packages because Go test helpers cannot be shared without exporting them; the duplication is documented at both sites. Acceptance criteria status (#5145): AC#1 (pkg/auth/dcr exists, exports a stateful resolver, consumed by both call sites): partially met — package exists and is consumed by EmbeddedAuthServer. CLI flow migration is sub-issue 4b (#5219). AC#2 (stateless RFC 7591 helpers in pkg/oauthproto): met (already satisfied before this PR). AC#3 (no direct oauthproto.RegisterClientDynamically calls outside pkg/auth/dcr): not yet met — pkg/auth/discovery still calls it. Resolved by sub-issue 4b (#5219). AC#4 (review-property behaviours apply to CLI flow): not yet met — same dependency on 4b (#5219). Closes #5220. Verified via task lint-fix (0 issues), task license-check (clean), and go test -count=1 -race ./pkg/auth/dcr/... ./pkg/authserver/... (all pass).

Commits

Commits on May 8, 2026

Extract DCR resolver into pkg/auth/dcr