rebase merge conflicts and fixes from review

Author: taskbot

cmd/thv-operator/api/v1alpha1/mcpserver_types.go

@@ -361,7 +361,16 @@ type SecretRef struct {
 	TargetEnvName string `json:"targetEnvName,omitempty"`
 }
 
-// SessionStorageConfig defines session storage configuration for horizontal scaling
+// SessionStorageConfig defines session storage configuration for horizontal scaling.
+//
+// This is the CRD/K8s-aware surface: it uses SecretKeyRef for secret resolution.
+// The reconciler resolves PasswordRef to a plain string and builds a
+// session.RedisConfig (pkg/transport/session) for the actual storage backend.
+//
+// TODO: Add a corresponding SessionStorageConfig to pkg/vmcp/config.Config so the
+// vMCP process receives session storage config through the existing config injection
+// path (same as Optimizer and Audit). The CRD type will remain separate because
+// PasswordRef is K8s-specific and gets resolved away before the config-pkg type.
 //
 // +kubebuilder:validation:XValidation:rule="self.provider == 'redis' ? has(self.address) : true",message="address is required"
 type SessionStorageConfig struct {

cmd/thv-operator/api/v1alpha1/virtualmcpserver_types_test.go

@@ -481,92 +481,6 @@ func TestValidateEmbeddingServer(t *testing.T) {
 	}
 }
 
-func TestValidateAuthServerConfig(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name        string
-		server      *VirtualMCPServer
-		expectError bool
-		errContains string
-	}{
-		{
-			name: "nil_config_passes",
-			server: &VirtualMCPServer{
-				Spec: VirtualMCPServerSpec{
-					Config: config.Config{Group: "test-group"},
-				},
-			},
-		},
-		{
-			name: "valid_config_passes",
-			server: &VirtualMCPServer{
-				Spec: VirtualMCPServerSpec{
-					Config: config.Config{Group: "test-group"},
-					AuthServerConfig: &EmbeddedAuthServerConfig{
-						Issuer: "http://localhost:9090",
-						UpstreamProviders: []UpstreamProviderConfig{
-							{
-								Name: "test",
-								Type: UpstreamProviderTypeOIDC,
-								OIDCConfig: &OIDCUpstreamConfig{
-									IssuerURL: "https://accounts.google.com",
-									ClientID:  "test-client",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "empty_issuer_errors",
-			server: &VirtualMCPServer{
-				Spec: VirtualMCPServerSpec{
-					Config: config.Config{Group: "test-group"},
-					AuthServerConfig: &EmbeddedAuthServerConfig{
-						Issuer: "",
-						UpstreamProviders: []UpstreamProviderConfig{
-							{Name: "test", Type: UpstreamProviderTypeOIDC},
-						},
-					},
-				},
-			},
-			expectError: true,
-			errContains: "spec.authServerConfig.issuer is required",
-		},
-		{
-			name: "no_upstreams_errors",
-			server: &VirtualMCPServer{
-				Spec: VirtualMCPServerSpec{
-					Config: config.Config{Group: "test-group"},
-					AuthServerConfig: &EmbeddedAuthServerConfig{
-						Issuer: "http://localhost:9090",
-					},
-				},
-			},
-			expectError: true,
-			errContains: "spec.authServerConfig.upstreamProviders is required",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			err := tt.server.Validate()
-			if tt.expectError {
-				require.Error(t, err)
-				if tt.errContains != "" {
-					assert.Contains(t, err.Error(), tt.errContains)
-				}
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}
-
 func TestVirtualMCPServerSpecScalingFieldsJSONRoundtrip(t *testing.T) {
 	t.Parallel()
 
@@ -621,4 +535,3 @@ func TestVirtualMCPServerSpecScalingFieldsJSONRoundtrip(t *testing.T) {
 		})
 	}
 }
-