Feat: DCR support in application auth strategy resources

[rspurgeon]

The API Specification can be found here:

https://developer.konghq.com/api/konnect/application-auth-strategies/v2/#/operations/create-dcr-provider

[rspurgeon]

/triage

[github-actions]

✅ Requested Issue Triage completed successfully!

[github-actions]

🎯 Agentic Issue Triage

This is a feature request to add DCR (Dynamic Client Registration) provider support to the application auth strategies functionality in kongctl. The feature would extend the existing auth strategy management to support a third strategy type alongside key_auth and openid_connect.

📋 Issue Analysis

Current State

The codebase already has robust support for application auth strategies with two strategy types:

• key_auth: Key-based authentication
• openid_connect: OpenID Connect authentication

The implementation follows kongctl's standard resource management pattern across:

• Helper layer (internal/konnect/helpers/app_auth_strategies.go)
• Resource definitions (internal/declarative/resources/auth_strategy.go)
• Planner (internal/declarative/planner/auth_strategy_planner.go)
• Executor (internal/declarative/executor/auth_strategy_adapter.go)
• State client (internal/declarative/state/client.go)

What's Missing

DCR (Dynamic Client Registration) provider support as specified in the [Konnect API docs]((developer.konghq.com/redacted)

✅ Implementation Checklist

To add DCR provider support, the following changes are needed:

• Update SDK Types (if not already present)

  • Verify CreateDcrProviderApplicationAuthStrategyRequest exists in Konnect SDK
  • Verify UpdateDcrProviderApplicationAuthStrategyRequest exists in Konnect SDK
  • Check union type handling in CreateAppAuthStrategyRequest and UpdateAppAuthStrategyRequest

• Resource Definition (internal/declarative/resources/auth_strategy.go)

  • Add dcr_provider to strategy type union handling
  • Update UnmarshalJSON to handle DCR provider config
  • Update MarshalJSON to serialize DCR provider requests
  • Add DCR-specific configuration fields

• Planner (internal/declarative/planner/auth_strategy_planner.go)

  • Verify DCR strategy comparison logic works with existing code
  • Test that strategy type changes are properly prevented

• Executor (internal/declarative/executor/auth_strategy_adapter.go)

  • Add DCR provider mapping in toPlanChange method
  • Ensure extractStringSlice handles DCR config fields
  • Update toCreateRequest and toUpdateRequest for DCR

• State Client (internal/declarative/state/client.go)

  • Verify list/get/create/update/delete operations work with DCR
  • Test label management with DCR strategies

• Tests

  • Unit tests for DCR resource marshaling/unmarshaling
  • Integration tests for DCR strategy CRUD operations
  • E2E tests for declarative config with DCR strategies

• Documentation

  • Update user docs to describe DCR provider strategy
  • Add examples of DCR configuration in declarative files
  • Document DCR-specific command usage

🔍 Code Patterns to Follow

The existing openid_connect implementation provides an excellent reference pattern:

// Resource definition pattern
type ApplicationAuthStrategyResource struct {
    Ref              *ApplicationAuthStrategyResourceRef `json:"$ref,omitempty"`
    Name             *string                             `json:"name,omitempty"`
    StrategyType     *string                             `json:"strategy_type,omitempty"`
    // Add DCR-specific configs here similar to KeyAuthConfig/OpenIDConfig
    DcrProviderConfig *DcrProviderConfig                 `json:"dcr_provider_config,omitempty"`
}

// Custom JSON handling pattern
func (r *ApplicationAuthStrategyResource) UnmarshalJSON(data []byte) error {
    // Handle union type based on strategy_type field
    switch strategyType {
    case "dcr_provider":
        // Unmarshal DCR-specific fields
    }
}

Key architectural principles:

1. Use union type pattern for strategy-specific configs
2. Custom JSON marshaling/unmarshaling for SDK compatibility
3. Label-based namespace and protection tracking
4. Prevent strategy type changes (create new strategy instead)

📚 Helpful Resources

• API Reference: [Konnect Application Auth Strategies v2 API]((developer.konghq.com/redacted)
• Existing Implementation: Study /internal/declarative/resources/auth_strategy.go for union type patterns
• SDK Integration: Review /internal/konnect/helpers/app_auth_strategies.go for API wrapper patterns
• Testing Patterns: Check existing auth strategy tests in test/integration/ and test/e2e/

💡 Development Tips

1. Start with the SDK: Verify the Konnect Go SDK has the necessary DCR types before implementation
2. Follow the pattern: The existing openid_connect strategy is the closest analog - use it as a template
3. Test incrementally: Build unit tests first, then integration, then E2E
4. Check union type handling: The SDK uses union types extensively - custom marshaling is required
5. Run gates: All changes must pass make format, make lint, and make test-all

---

Priority: Medium - This is an enhancement that extends existing functionality with a clear API specification and established patterns to follow.

AI generated by Requested Issue Triage