Add CABundleRef support to TokenExchangeConfig in MCPExternalAuthConfig

Summary

When using token exchange with a corporate IdP that uses internal/custom CA certificates, users cannot configure a CA bundle for the token exchange HTTP client. The OIDC configuration supports CABundleRef, but the TokenExchangeConfig in MCPExternalAuthConfig does not.

Problem

The token exchange HTTP client (pkg/auth/tokenexchange/exchange.go) uses only system CAs:

var defaultHTTPClient = &http.Client{
    Timeout: defaultHTTPTimeout,
}

If a corporate IdP's token endpoint uses a certificate signed by an internal CA, token exchange requests will fail with TLS verification errors.

Proposed Solution

Add CABundleRef support to TokenExchangeConfig:

Files to Modify

1. CRD (cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.go):

   • Add CABundleRef *CABundleSource to TokenExchangeConfig struct

2. Core package (pkg/auth/tokenexchange/middleware.go):

   • Add CACertPath string field to Config struct

3. Token exchange client (pkg/auth/tokenexchange/exchange.go):

   • Modify createTokenExchangeMiddleware() to create an HTTP client with CA bundle support using networking.NewHttpClientBuilder().WithCABundle()

4. Operator utilities (cmd/thv-operator/pkg/controllerutil/tokenexchange.go):

   • Resolve CA bundle path from CABundleRef
   • Add validation for CABundleRef

5. Volume mounting (deployment controllers):

   • Mount CA bundle ConfigMap as volume for token exchange

6. Runner config (pkg/runner/options.go):

   • Update WithTokenExchangeConfig() to accept CA cert path

7. Tests and documentation

Related

This is similar to the CABundleRef support added for InlineOIDCConfig and ConfigMapOIDCRef in the OIDC configuration.

Acceptance Criteria

• TokenExchangeConfig CRD has caBundleRef field
• Token exchange HTTP client uses configured CA bundle
• Volume mounting works for CA bundle ConfigMap
• Unit tests cover CA bundle path resolution
• CRD documentation updated

Start by tracing the existing OIDC CABundleRef support, then inspect the listed CRD, token exchange, operator utility, deployment controller, and runner configuration files. Run the relevant token exchange and controller tests before changing behavior. Done means the CRD, CA bundle resolution, client configuration, volume mounting, tests, and documentation all cover the acceptance criteria.