OIDC callback (first sign-in completion: state/nonce validation, code exchange, session cookie) #25

Merged

ginjiruu merged 2 commits from feat/oidc-callback into master

2026-09-15 17:26:15 +00:00

ginjiruu commented

2026-09-15 04:55:17 +00:00

Owner

Closes #16

Replaces the :8082 stub handler with the OIDC callback — first sign-in completing:

Validates the state URL param against the state/nonce cookie (CSRF); a forged callback is rejected (403, token endpoint not called).
Resolves the App from the state cookie's appKey (no reliance on the gateway forwarding the Host to :8082).
Exchanges the code via the authorization_code grant using the client secret (asserted on the token-endpoint double's received form).
Sets the plain Session cookie (id_token + refresh_token, Max-Age from OidcSession.TTL) and 302s the browser to returnTo (from the cookie, not the state URL param, so the return URL is not logged by the IdP or leaked in the redirect).
Fail-closed (ADR 0011): every exchange failure path is a 503 before any Session is set; the state cookie is cleared on success (single-use nonce).

Verified TDD-first: 10 callback tests (happy path incl. a PathEscape round-trip for special characters, forged/missing/malformed state, unknown appKey, unregistered path, secret-not-ready, endpoint failure table, unreachable endpoint, missing code), all RED before implementation and GREEN after. Full suite green (-p 1). Two-axis code review: no hard standard violations; edge-case notes (root-registered callback URL, multi-URL redirect_uri) are safe under fail-closed.

Closes #16 Replaces the `:8082` stub handler with the OIDC callback — first sign-in completing: - Validates the `state` URL param against the state/nonce cookie (CSRF); a forged callback is rejected (403, token endpoint not called). - Resolves the App from the state cookie's `appKey` (no reliance on the gateway forwarding the Host to `:8082`). - Exchanges the `code` via the `authorization_code` grant using the client secret (asserted on the token-endpoint double's received form). - Sets the plain Session cookie (id_token + refresh_token, Max-Age from `OidcSession.TTL`) and 302s the browser to `returnTo` (from the cookie, not the `state` URL param, so the return URL is not logged by the IdP or leaked in the redirect). - Fail-closed (ADR 0011): every exchange failure path is a 503 before any Session is set; the state cookie is cleared on success (single-use nonce). Verified TDD-first: 10 callback tests (happy path incl. a PathEscape round-trip for special characters, forged/missing/malformed state, unknown appKey, unregistered path, secret-not-ready, endpoint failure table, unreachable endpoint, missing code), all RED before implementation and GREEN after. Full suite green (`-p 1`). Two-axis code review: no hard standard violations; edge-case notes (root-registered callback URL, multi-URL `redirect_uri`) are safe under fail-closed.

ginjiruu added 1 commit

2026-09-15 04:55:17 +00:00

add oidc callback: state/nonce validation, app resolution, authorization_code grant, session cookie, 302 to returnTo

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled