OIDC lazy refresh (margin-gated refresh_token grant, cookie re-issue, fail-closed 302) #26

Merged

ginjiruu merged 2 commits from feat/oidc-lazy-refresh into master

2026-09-15 17:23:05 +00:00

ginjiruu commented

2026-09-15 04:55:18 +00:00

Owner

Closes #17

Adds the OIDC lazy refresh (keep-alive) on the :8083 Check path:

When id_token.exp − now < 60s (including already-expired), the Check renews the Session via the refresh_token grant using the client secret (asserted on the token-endpoint double's received form: grant_type=refresh_token, the exact refresh_token, client_id, client_secret).
Re-issues the Session cookie via OkHttpResponse.response_headers_to_add (Set-Cookie, Max-Age from OidcSession.TTL, 12h default), then validates the NEW id_token with the full JWKS check before OK + claim injection.
A failed refresh (grant rejection, unreachable endpoint, mis-signed renewed token, no refresh_token) invalidates the Session and 302s to the authorization endpoint (fail-closed).
A mis-signed or mis-issued token that is not merely just-old never reaches the token endpoint (302, zero calls).

Verified TDD-first: 8 new tests (near-expiry, expired, healthy-no-call, rejection 302, unreachable 302, mis-signed-renewed 302, no-refresh-token 302-without-a-call, mis-signed-not-just-old 302-without-a-call, no-rotation keeps the old refresh_token), plus TestOIDCExpiredTokenIsA302 updated to cover "expired without a usable refresh → 302". Full suite green (-p 1). Two-axis code review: no hard standard violations; noted for follow-up — TokenEndpoint emptiness surfaces as a failed-refresh 302 rather than the 503 class (inherited from the steady-state availability gate).

Closes #17 Adds the OIDC lazy refresh (keep-alive) on the `:8083` Check path: - When `id_token.exp − now < 60s` (including already-expired), the Check renews the Session via the `refresh_token` grant using the client secret (asserted on the token-endpoint double's received form: `grant_type=refresh_token`, the exact `refresh_token`, `client_id`, `client_secret`). - Re-issues the Session cookie via `OkHttpResponse.response_headers_to_add` (`Set-Cookie`, Max-Age from `OidcSession.TTL`, 12h default), then validates the NEW `id_token` with the full JWKS check before OK + claim injection. - A failed refresh (grant rejection, unreachable endpoint, mis-signed renewed token, no refresh_token) invalidates the Session and 302s to the authorization endpoint (fail-closed). - A mis-signed or mis-issued token that is not merely just-old never reaches the token endpoint (302, zero calls). Verified TDD-first: 8 new tests (near-expiry, expired, healthy-no-call, rejection 302, unreachable 302, mis-signed-renewed 302, no-refresh-token 302-without-a-call, mis-signed-not-just-old 302-without-a-call, no-rotation keeps the old refresh_token), plus `TestOIDCExpiredTokenIsA302` updated to cover "expired without a usable refresh → 302". Full suite green (`-p 1`). Two-axis code review: no hard standard violations; noted for follow-up — `TokenEndpoint` emptiness surfaces as a failed-refresh 302 rather than the 503 class (inherited from the steady-state availability gate).

ginjiruu added 1 commit

2026-09-15 04:55:18 +00:00

add oidc lazy refresh: margin-gated refresh_token grant, cookie re-issue, fail-closed 302

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled