State-model amendment: resolve + carry end_session_endpoint #13

New issue

Closed

opened 2026-09-14 17:04:55 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:55 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

A small state-model amendment: the leader's IdP discovery resolve also extracts end_session_endpoint, and the OIDC section of the resolved state (Registry Entry + Snapshot) carries it — so RP-initiated logout (EndSession=true) works without a per-request discovery fetch. This is an additive change to the already-built resolve step (discovery is already fetched; extract one more field).

Acceptance criteria

The leader's IdP discovery resolve extracts end_session_endpoint from the discovery document.
The OIDC section of the Registry Entry and the Snapshot carries end_session_endpoint.
An absent end_session_endpoint in the discovery document is handled (the field is empty; EndSession is a no-op / validation error per policy).
Verified via the existing stubIdP httptest double (a new discovery assertion) + the existing envtest leader path.

Blocked by

None — can start immediately.

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build A small state-model amendment: the leader's IdP discovery resolve also extracts `end_session_endpoint`, and the OIDC section of the resolved state (Registry `Entry` + Snapshot) carries it — so RP-initiated logout (`EndSession=true`) works without a per-request discovery fetch. This is an additive change to the already-built resolve step (discovery is already fetched; extract one more field). ## Acceptance criteria - [ ] The leader's IdP discovery resolve extracts `end_session_endpoint` from the discovery document. - [ ] The `OIDC` section of the Registry `Entry` and the Snapshot carries `end_session_endpoint`. - [ ] An absent `end_session_endpoint` in the discovery document is handled (the field is empty; `EndSession` is a no-op / validation error per policy). - [ ] Verified via the existing `stubIdP` httptest double (a new discovery assertion) + the existing envtest leader path. ## Blocked by None — can start immediately.

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:33 +00:00

~~ginjiruu referenced this issue 2026-09-14 17:05:33 +00:00~~

Exchange Check #15

~~ginjiruu referenced this issue 2026-09-14 17:05:34 +00:00~~

OIDC callback (first sign-in) #16

ginjiruu referenced this issue

2026-09-14 17:06:37 +00:00

Logout (clear cookie + RP-initiated) #19

ginjiruu added the

ready-for-agent

label