Integration Tests for Embedded Auth Server

[tgrunnagle]

Depends on #3541

Summary

Adds integration tests for the embedded authorization server to ensure OAuth/OIDC endpoints work correctly when integrated with the proxy runner and operate alongside MCP endpoints without conflict.

Related Issue: stacklok/stacklok-epics#234

Why This Change

The embedded auth server is a critical component that enables MCP clients to authenticate using standard OAuth 2.0 flows. Without integration tests, we risk:

• Breaking OAuth/OIDC discovery endpoints that clients depend on for configuration
• Introducing routing conflicts between auth endpoints and MCP endpoints
• Resource leaks if cleanup isn't handled properly
• Regressions in RFC 8707 (resource indicators) compliance required by MCP spec

What's Tested

OAuth/OIDC Compliance

• Discovery endpoints return valid metadata (JWKS, OAuth AS Metadata, OIDC Discovery)
• Authorization flow correctly redirects to upstream IDP
• RFC 8707 resource parameter is enforced (required for MCP)
• Dynamic Client Registration (RFC 7591) works correctly
• Token endpoint properly rejects invalid requests

Runner Integration

• Auth endpoints are mounted at correct URL prefixes
• OAuth endpoints don't interfere with MCP endpoints
• Auth server handles concurrent requests safely
• Resources are cleaned up properly when runner stops

Configuration Validation

• Missing required config (audiences, upstreams) produces clear errors
• Invalid issuer URLs are rejected
• Both ephemeral (dev mode) and file-based signing keys work

Test Approach

Tests use a mock upstream IDP rather than real OAuth providers to:

• Enable parallel test execution without external dependencies
• Provide deterministic, reproducible results
• Allow testing edge cases and error conditions

Files Changed

test/integration/authserver/
├── authserver_integration_test.go    # Auth server functionality tests
├── runner_integration_test.go        # Runner integration tests
├── README.md                         # Test documentation
└── helpers/
    ├── authserver.go                 # Auth server test utilities
    ├── http_client.go                # OAuth client for testing flows
    └── mock_upstream.go              # Mock upstream IDP

+1,406 lines across 6 new files

Large PR Justification

• All changes are part of one integration test suite

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

[codecov]

Codecov Report

❌ Patch coverage is 67.27273% with 54 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.54%. Comparing base (a82c591) to head (f0a7f57).
⚠️ Report is 30 commits behind head on main.

Files with missing lines	Patch %	Lines
test/integration/authserver/helpers/http_client.go	64.21%	18 Missing and 16 partials ⚠️
test/integration/authserver/helpers/authserver.go	71.42%	19 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #3556    +/-   ##
========================================
  Coverage   65.53%   65.54%            
========================================
  Files         405      408     +3     
  Lines       39678    40248   +570     
========================================
+ Hits        26004    26379   +375     
- Misses      11672    11808   +136     
- Partials     2002     2061    +59     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review.

Large PR justification has been provided. Thank you!