Extract DCR resolver into pkg/auth/dcr

[tgrunnagle]

DRAFT - not ready for review

Summary

• Why: Issue Consolidate the two RFC 7591 DCR client implementations into pkg/auth/dcr #5145 calls for consolidating two parallel RFC 7591 Dynamic Client Registration (DCR) implementations (pkg/authserver/runner/dcr.go and pkg/auth/discovery::PerformOAuthFlow) into a single shared pkg/auth/dcr package, so review-derived behaviours (S256 PKCE gate, RFC 7591 §3.2.1 expiry refetch, redirect refusal, panic recovery, singleflight) cannot diverge between the embedded authserver and the CLI flow as future consumers land. The full migration is too large for a single PR, so this slice (sub-issue 4a) does the package extraction and migrates the embedded authserver only.
• What: Extracts the DCR resolver and credential store from pkg/authserver/runner into a new pkg/auth/dcr package and migrates EmbeddedAuthServer to consume it. File moves use git mv so the diff renders as renames rather than delete+add. Public symbols are renamed to drop the redundant DCR prefix on packagisation (e.g., DCRResolution → dcr.Resolution, DCRCredentialStore → dcr.CredentialStore, resolveDCRCredentials → dcr.ResolveCredentials). Adds a parallel TestResolveSecret suite mirroring the runner-package twin so any future drift between the two resolveSecret copies fails CI.

Closes #5220 (sub-issue 4a). Part of #5145 — does not close the parent. Sibling sub-issue #5219 (4b — CLI flow migration in pkg/auth/discovery::PerformOAuthFlow) closes #5145 when it lands; AC#1, AC#3, and AC#4 of the parent depend on it.

Stacking

This branch is stacked on PR #5196 (dcr-3c_issue_5185 — "Wire persistent DCRCredentialStore into EmbeddedAuthServer"), which is itself stacked on PRs #5186 and #5195. The earlier commits on this branch (c0fed523 through 781a0b97) implement sub-issues #5183 / #5184 / #5185 (the persistent DCR store and Redis backend) and are shown for context only — review against PR #5196 once it merges, or review the two commits unique to this branch in isolation:

• df84256f Extract DCR resolver into pkg/auth/dcr
• 633ed9ed Address code review feedback

Type of change

• Refactoring (no behavior change)

Test plan

• Unit tests (task test) — go test -count=1 -race ./pkg/auth/dcr/... ./pkg/authserver/... all pass
• Linting (task lint-fix) — 0 issues
• License check (task license-check) — clean

Changes

File	Change
pkg/auth/dcr/resolver.go	Renamed from pkg/authserver/runner/dcr.go; public symbols renamed to drop the DCR prefix; package doc updated with a # Concurrency section documenting the process-global singleflight; new flightKeyOf(Key) helper makes the canonical key shape inspectable; endpointsFromMetadata gains a defensive nil check and an oauthproto contract note.
pkg/auth/dcr/store.go	Renamed from pkg/authserver/runner/dcr_store.go; constructors renamed (NewInMemoryStore, NewStorageBackedStore); type renamed to CredentialStore.
pkg/auth/dcr/resolver_test.go	Renamed from pkg/authserver/runner/dcr_test.go; updated for new package boundary and renamed symbols.
pkg/auth/dcr/store_test.go	Renamed from pkg/authserver/runner/dcr_store_test.go; updated for new package boundary.
pkg/auth/dcr/secret_test.go	New parallel resolveSecret suite that mirrors the runner-package twin's observable contract so future drift between the two duplicated helpers fails CI on at least one side.
pkg/authserver/runner/embeddedauthserver.go	Migrated to consume pkg/auth/dcr; doc comments on buildUpstreamConfigs and DCRStore() updated to use the new public names.
pkg/authserver/runner/embeddedauthserver_test.go	Updated import paths and constructor names for the moved types.

Does this introduce a user-facing change?

No. This is an internal refactor. The embedded authserver's externally-observable DCR behaviour (registration, caching, error reporting, structured logging, expiry refetch, S256 gating) is unchanged.

Implementation plan

Approved implementation plan

Sub-issue 4a (#5220) of #5145 — extract the resolver into pkg/auth/dcr and migrate the embedded authserver only. Defer the pkg/auth/discovery::PerformOAuthFlow migration to sub-issue 4b (#5219) so this slice stays under the 400-line / 10-file PR-size limit.

Profile-neutral input shape: the package's API still takes embedded-authserver types directly. Designing a profile-neutral input type with only one consumer in hand would be speculative; the right design moment is when 4b lands the CLI flow as the second consumer. The package doc comment in pkg/auth/dcr/resolver.go calls this coupling out explicitly and labels the profile-agnostic framing as a target state for 4b rather than the current API shape.

Duplication of resolveSecret: deliberately duplicated across pkg/authserver/runner and pkg/auth/dcr because the DCR package must stay reachable-from-runner-but-not-back. Promoting to a shared helper is deferred until 4b lands a third call site. Drift between the two copies is guarded by parallel test suites with identical observable contracts.

Special notes for reviewers

• Why renames, not delete+add: file moves use git mv so the diff renders as renames. The percentage similarity in git log --stat --follow reflects that the bulk of the move is mechanical and the substantive deltas are confined to (a) the package doc rewrite at the top of resolver.go, (b) the flightKeyOf extraction and singleflight comment, (c) the endpointsFromMetadata nil guard, and (d) the import/symbol rename sweep in embeddedauthserver.go.
• Singleflight is process-global, not per-instance: documented at the package surface and on the dcrFlight var. The cross-consumer caveat ("third consumer with colliding redirect URI" failure mode) is named explicitly so the next migration cannot silently re-introduce a collision.
• Acceptance criteria status against Consolidate the two RFC 7591 DCR client implementations into pkg/auth/dcr #5145 (as per the commit message of df84256f):
  • AC#1 (pkg/auth/dcr exists, exports a stateful resolver, consumed by both call sites): partially met — package exists and is consumed by EmbeddedAuthServer. CLI flow migration is sub-issue 4b (Migrate CLI OAuth flow to pkg/auth/dcr resolver #5219).
  • AC#2 (stateless RFC 7591 helpers in pkg/oauthproto): met (already satisfied before this PR).
  • AC#3 (no direct oauthproto.RegisterClientDynamically calls outside pkg/auth/dcr): not yet met — pkg/auth/discovery still calls it. Resolved by sub-issue 4b (Migrate CLI OAuth flow to pkg/auth/dcr resolver #5219).
  • AC#4 (review-property behaviours apply to CLI flow): not yet met — same dependency on 4b (Migrate CLI OAuth flow to pkg/auth/dcr resolver #5219).

[codecov]

Codecov Report

❌ Patch coverage is 80.39216% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.91%. Comparing base (9211a36) to head (81b9e02).

Files with missing lines	Patch %	Lines
pkg/auth/dcr/resolver.go	79.41%	6 Missing and 1 partial ⚠️
pkg/auth/dcr/store.go	75.00%	2 Missing ⚠️
pkg/authserver/runner/embeddedauthserver.go	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5198      +/-   ##
==========================================
+ Coverage   67.86%   67.91%   +0.05%     
==========================================
  Files         610      610              
  Lines       62522    62543      +21     
==========================================
+ Hits        42431    42478      +47     
+ Misses      16910    16880      -30     
- Partials     3181     3185       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.