Extract resolveOIDCConfig helper in VirtualMCPServer converter

[ChrisJBurns]

Summary

• Review feedback from Wire MCPOIDCConfig into VirtualMCPServer controller #4493 suggested collapsing the two OIDC resolution branches in convertIncomingAuth into a single helper, making incoming immutable after construction.
• The new resolveOIDCConfig method returns (*vmcpconfig.OIDCConfig, error), encapsulating both the MCPOIDCConfigRef path and the legacy inline OIDCConfig path. This simplifies convertIncomingAuth to a single assignment.

Ref: #4493 (comment)

Type of change

• Refactoring (no behavior change)

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
pkg/vmcpconfig/converter.go	Extract resolveOIDCConfig from convertIncomingAuth; simplify convertIncomingAuth to single OIDC assignment

Does this introduce a user-facing change?

No

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 47.82609% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.11%. Comparing base (862f9b8) to head (2111396).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/thv-operator/pkg/vmcpconfig/converter.go	47.82%	10 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4505   +/-   ##
=======================================
  Coverage   69.11%   69.11%           
=======================================
  Files         502      502           
  Lines       51869    51875    +6     
=======================================
+ Hits        35848    35853    +5     
+ Misses      13243    13242    -1     
- Partials     2778     2780    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jerm-dro]

@claude ensure no behaviors have changed during this refactor

[claude]

Claude finished @jerm-dro's task in 1m 8s —— View job

---

Behavioral equivalence verification

• Read the changed file
• Analyze the git diff for behavioral equivalence
• Verify error paths are identical
• Verify return values are identical
• Post findings

---

Verdict: No behavioral changes. The refactor is equivalent.

Here's a detailed comparison of the critical paths:

convertIncomingAuth — before vs after

Before (old code):

// mutable incoming, OIDC set conditionally after construction
incoming := &vmcpconfig.IncomingAuthConfig{Type: vmcp.Spec.IncomingAuth.Type}
if vmcp.Spec.IncomingAuth.OIDCConfigRef != nil {
    ...
    if resolvedConfig != nil {   // <-- nil guard before mapping
        incoming.OIDC = mapResolvedOIDCToVmcpConfigFromRef(resolvedConfig, oidcCfg)
    }
} else if vmcp.Spec.IncomingAuth.OIDCConfig != nil {
    ...
    if resolvedConfig != nil {   // <-- nil guard before mapping
        incoming.OIDC = mapResolvedOIDCToVmcpConfig(resolvedConfig, vmcp.Spec.IncomingAuth.OIDCConfig)
    }
}

After (new code):

// immutable incoming, OIDC set at construction time
oidcConfig, err := c.resolveOIDCConfig(ctx, vmcp)
incoming := &vmcpconfig.IncomingAuthConfig{
    Type: vmcp.Spec.IncomingAuth.Type,
    OIDC: oidcConfig,
}

Why the nil guard removal is safe

The old code guarded mapResolvedOIDCToVmcpConfigFromRef and mapResolvedOIDCToVmcpConfig with if resolvedConfig != nil. Both of those functions already have their own nil guards at the top:

func mapResolvedOIDCToVmcpConfigFromRef(resolved *oidc.OIDCConfig, ...) *vmcpconfig.OIDCConfig {
    if resolved == nil {
        return nil   // <-- safe, returns nil either way
    }
    ...
}

So when resolved == nil:

• Old: if resolvedConfig != nil is false → incoming.OIDC stays nil
• New: mapResolvedOIDCToVmcpConfigFromRef(nil, ...) returns nil → incoming.OIDC = nil

Net result is identical.

Error paths — identical

All error messages, error conditions, and ctxLogger.Error(...) calls in the two branches are preserved verbatim in resolveOIDCConfig.

The extra nil guard in resolveOIDCConfig

// line 215-217
if vmcp.Spec.IncomingAuth == nil {
    return nil, nil
}

This is dead code since resolveOIDCConfig is only called from convertIncomingAuth, which is only called when vmcp.Spec.IncomingAuth != nil (guarded in Convert at line 86). Defensive but not a behavior change.

---

Summary: The refactor is a pure structural improvement — extracting the two OIDC resolution branches into resolveOIDCConfig and making incoming immutable after construction. All error paths, log messages, return values, and conditional logic are preserved exactly.