mathiasandClaude Opus 4.7
668e8fa28d
/healthz now returns JSON with three-state JWT status: disabled
(DEX_ISSUER_URL unset), enabled (validator initialized), or
degraded (configured but init failed — only static-token auth
currently accepted). last_error surfaces the init failure so ops
can correlate with Dex outage windows.
Partial fix for #6. The cited internal/auth/jwt.go moved out
of this repo in 658f4ba (mcp-chassis migration); per-attempt
logging and 503 + WWW-Authenticate temporarily_unavailable
require chassis-side changes and a coordinated v0.1.1 bump
across all MCP consumers — tracked separately.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
type healthStatus struct {
|
|
OK bool `json:"ok"`
|
|
JWT jwtStatus `json:"jwt"`
|
|
}
|
|
|
|
// jwtStatus surfaces the runtime state of the Dex JWT validator so ops
|
|
// can distinguish "Dex unreachable at startup" from "JWT auth not
|
|
// configured" — both previously degraded silently to static-token-only
|
|
// (refs hyperguild/gitea-mcp#6).
|
|
type jwtStatus struct {
|
|
// Status is one of: "disabled" (DEX_ISSUER_URL not set),
|
|
// "enabled" (validator initialized), "degraded" (configured but
|
|
// init failed; only static-token auth currently accepted).
|
|
Status string `json:"status"`
|
|
LastError string `json:"last_error,omitempty"`
|
|
}
|
|
|
|
func newHealthzHandler(dexConfigured, validatorReady bool, initErr error) http.HandlerFunc {
|
|
status := healthStatus{OK: true, JWT: jwtStatus{Status: jwtStatusFor(dexConfigured, validatorReady)}}
|
|
if initErr != nil {
|
|
status.JWT.LastError = initErr.Error()
|
|
}
|
|
body, _ := json.Marshal(status)
|
|
return func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write(body)
|
|
}
|
|
}
|
|
|
|
func jwtStatusFor(dexConfigured, validatorReady bool) string {
|
|
switch {
|
|
case !dexConfigured:
|
|
return "disabled"
|
|
case validatorReady:
|
|
return "enabled"
|
|
default:
|
|
return "degraded"
|
|
}
|
|
}
|