State-model amendment: resolve + carry end_session_endpoint #22

Merged

ginjiruu merged 1 commit from feat/end-session-endpoint into master

2026-09-15 00:51:05 +00:00

ginjiruu commented

2026-09-14 22:01:16 +00:00

Owner

Closes #13

What

State-model amendment: the leader's IdP discovery resolve also extracts end_session_endpoint, and the OIDC section of the resolved state (Registry Entry + Snapshot) carries it — so RP-initiated logout (EndSession=true) works without a per-request discovery fetch. Additive to the already-built resolve step (discovery is already fetched; one more field extracted).

Changes

internal/idp: discovery/Resolved gain EndSessionEndpoint; validate deliberately does not require it — an absent end_session_endpoint resolves to the empty field, no error.
internal/registry: Entry.OIDC carries EndSessionEndpoint (json:"endSessionEndpoint,omitempty"); the builder copies it from the resolved state into the OIDC section.
internal/snapshot: the field rides the existing copyEntry deep copy (string value copy) — covered by the carried-section and isolation tests.

Verification (per the ACs)

New discovery assertions on the existing stubIdP doubles: TestResolveReturnsEndSessionEndpoint (extracted) and TestResolveToleratesAnAbsentEndSessionEndpoint (absent → empty, no failure) in internal/idp.
Registry Build test asserts the OIDC section carries the endpoint.
Existing envtest leader path: leader_freshness_test.go gains a spec (client + OidcPolicy → OIDC section holds the resolved endpoint), and the existing oauthclient_controller_test.go / oidcpolicy_controller_test.go OIDC-section assertions assert it too.
make test (full suite, envtest) green; make lint clean.

Closes #13 ## What State-model amendment: the leader's IdP discovery resolve also extracts `end_session_endpoint`, and the OIDC section of the resolved state (Registry `Entry` + Snapshot) carries it — so RP-initiated logout (`EndSession=true`) works without a per-request discovery fetch. Additive to the already-built resolve step (discovery is already fetched; one more field extracted). ## Changes - `internal/idp`: `discovery`/`Resolved` gain `EndSessionEndpoint`; `validate` deliberately does not require it — an absent `end_session_endpoint` resolves to the empty field, no error. - `internal/registry`: `Entry.OIDC` carries `EndSessionEndpoint` (`json:"endSessionEndpoint,omitempty"`); the builder copies it from the resolved state into the OIDC section. - `internal/snapshot`: the field rides the existing `copyEntry` deep copy (string value copy) — covered by the carried-section and isolation tests. ## Verification (per the ACs) - New discovery assertions on the existing `stubIdP` doubles: `TestResolveReturnsEndSessionEndpoint` (extracted) and `TestResolveToleratesAnAbsentEndSessionEndpoint` (absent → empty, no failure) in `internal/idp`. - Registry `Build` test asserts the OIDC section carries the endpoint. - Existing envtest leader path: `leader_freshness_test.go` gains a spec (client + OidcPolicy → OIDC section holds the resolved endpoint), and the existing `oauthclient_controller_test.go` / `oidcpolicy_controller_test.go` OIDC-section assertions assert it too. - `make test` (full suite, envtest) green; `make lint` clean.

ginjiruu added 1 commit

2026-09-14 22:01:16 +00:00

add state-model amendment: resolve + carry end_session_endpoint

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled