Merge branch 'cimd-phase2-pr2-storage-decorator' into cimd-phase2-pr3-wiring

amirejaz · amirejaz · commit 497845977fa3 · 2026-05-21T18:00:56.000+05:00
diff --git a/pkg/authserver/server_impl.go b/pkg/authserver/server_impl.go
@@ -107,7 +107,6 @@ func newServer(ctx context.Context, cfg Config, stor storage.Storage, opts ...se
 	// provably safe for the production backends; surfacing a bad backend as
 	// a constructor error keeps misconfiguration fail-loud at boot rather
 	// than at first DCR resolve.
-	//
 	baseStore := unwrapStorage(stor)
 	dcrStore, ok := baseStore.(storage.DCRCredentialStore)
 	if !ok {
diff --git a/pkg/authserver/storage/cimd_decorator_test.go b/pkg/authserver/storage/cimd_decorator_test.go
@@ -383,6 +383,12 @@ func TestBuildFositeClient_LoopbackRedirectWrapsInLoopbackClient(t *testing.T) {
 	}
 	_, ok := got.(loopbackMatcher)
 	assert.True(t, ok, "loopback redirect URI must produce a LoopbackClient")
+
+	// TokenEndpointAuthMethod must be preserved through the LoopbackClient wrapper.
+	oidc, ok := got.(fosite.OpenIDConnectClient)
+	require.True(t, ok, "LoopbackClient must implement fosite.OpenIDConnectClient")
+	assert.Equal(t, "none", oidc.GetTokenEndpointAuthMethod(),
+		"loopback client must preserve TokenEndpointAuthMethod from the OIDC client")
 }
 
 func TestBuildFositeClient_NonLoopbackRedirectReturnsOpenIDConnectClient(t *testing.T) {

Original file line number	Diff line number	Diff line change
`@@ -383,6 +383,12 @@ func TestBuildFositeClient_LoopbackRedirectWrapsInLoopbackClient(t *testing.T) {`
`383`	`383`	`}`
`384`	`384`	`_, ok := got.(loopbackMatcher)`
`385`	`385`	`assert.True(t, ok, "loopback redirect URI must produce a LoopbackClient")`
	`386`	`+`
	`387`	`+ // TokenEndpointAuthMethod must be preserved through the LoopbackClient wrapper.`
	`388`	`+ oidc, ok := got.(fosite.OpenIDConnectClient)`
	`389`	`+ require.True(t, ok, "LoopbackClient must implement fosite.OpenIDConnectClient")`
	`390`	`+ assert.Equal(t, "none", oidc.GetTokenEndpointAuthMethod(),`
	`391`	`+ "loopback client must preserve TokenEndpointAuthMethod from the OIDC client")`
`386`	`392`	`}`
`387`	`393`
`388`	`394`	`func TestBuildFositeClient_NonLoopbackRedirectReturnsOpenIDConnectClient(t *testing.T) {`