gitea-mcp/cmd/gitea-mcp/healthz.go

package main

import (
	"context"
	"encoding/json"
	"net/http"
)

type healthStatus struct {
	OK  bool      `json:"ok"`
	JWT jwtStatus `json:"jwt"`
}

// jwtStatus surfaces the runtime state of the Dex JWT validator so ops
// can distinguish "Dex unreachable at startup" from "JWT auth not
// configured" — both previously degraded silently to static-token-only
// (refs hyperguild/gitea-mcp#6).
type jwtStatus struct {
	// Status is one of: "disabled" (DEX_ISSUER_URL not set),
	// "enabled" (validator initialized), "degraded" (configured but
	// init failed; only static-token auth currently accepted).
	Status    string `json:"status"`
	LastError string `json:"last_error,omitempty"`
}

// readinessFn reports whether JWT validation is currently possible, and why
// not. chassisauth.JWTValidator.Ready satisfies it.
type readinessFn func(context.Context) (bool, error)

// newHealthzHandler reports the CURRENT state, evaluated per request.
//
// It used to marshal one body at startup and serve those bytes forever. That is
// how gitea-mcp reported jwt.status=degraded for six days after Authentik had
// recovered (mcp-chassis#4): the answer was computed before the IdP was up and
// could never change. Fixing the validator alone would not have fixed this —
// the validator would recover and /healthz would keep saying degraded.
//
// Calling ready() per request is also what drives recovery: the chassis resolves
// a pending issuer on demand, so every probe is a retry.
func newHealthzHandler(dexConfigured bool, ready readinessFn) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		status := healthStatus{OK: true, JWT: jwtStatus{Status: "disabled"}}
		if dexConfigured {
			ok, err := ready(r.Context())
			status.JWT.Status = jwtStatusFor(true, ok)
			if err != nil {
				status.JWT.LastError = err.Error()
			}
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(status)
	}
}

// newReadyzHandler is the kubelet's probe: 503 while JWT auth is degraded.
//
// /healthz stays 200 deliberately — the process is alive and a liveness probe
// must not restart it, because restarting does not make the IdP come back any
// sooner. Readiness is the right lever: k8s stops routing OAuth callers to a pod
// that would 401 them, and the probe's own cadence becomes the retry loop with
// no background goroutine to own.
//
// A server with no issuer configured is always ready. Making readiness depend on
// an issuer it was never given would pull every static-token-only MCP out of its
// Service.
func newReadyzHandler(dexConfigured bool, ready readinessFn) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if !dexConfigured {
			w.WriteHeader(http.StatusOK)
			return
		}
		ok, err := ready(r.Context())
		if !ok {
			w.Header().Set("Content-Type", "application/json")
			w.WriteHeader(http.StatusServiceUnavailable)
			msg := ""
			if err != nil {
				msg = err.Error()
			}
			_ = json.NewEncoder(w).Encode(healthStatus{
				OK:  false,
				JWT: jwtStatus{Status: "degraded", LastError: msg},
			})
			return
		}
		w.WriteHeader(http.StatusOK)
	}
}

func jwtStatusFor(dexConfigured, validatorReady bool) string {
	switch {
	case !dexConfigured:
		return "disabled"
	case validatorReady:
		return "enabled"
	default:
		return "degraded"
	}
}