OIDC Flow to the trio: x/oauth2 + go-oidc (StaticKeySet, ES256) #40

Merged

ginjiruu merged 1 commit from t34-oidc-trio into t33-securecookie

2026-09-16 00:51:16 +00:00

ginjiruu commented

2026-09-16 00:38:30 +00:00

Owner

Closes #34

Replace the hand-rolled OIDC protocol code with the trio: golang.org/x/oauth2 (authorization URL, authorization-code exchange, refresh grant) and coreos/go-oidc/v3 (id_token validation over a StaticKeySet parsed from the leader-resolved JWKS, ES256). The hand-rolled token-endpoint form-POSTs and internal/jwt are removed; discovery + JWKS stay leader-resolved (no serving-path IdP I/O). Behaviour is preserved (confidential client, no PKCE yet — that is #36).

go-oidc NewVerifier(issuer, &StaticKeySet{PublicKeys}, &Config{ClientID: aud, SupportedSigningAlgs: [ES256]}); x/oauth2 AuthStyleInParams keeps client_id/client_secret in the form body (no Basic-auth probe).
The justOld lazy-refresh heuristic is kept (it reads unverified claims, independent of the signature library).

Stacked on #33. Part of the public-client + trio effort (spec #31).

Closes #34 Replace the hand-rolled OIDC protocol code with the trio: `golang.org/x/oauth2` (authorization URL, authorization-code exchange, refresh grant) and `coreos/go-oidc/v3` (id_token validation over a `StaticKeySet` parsed from the leader-resolved JWKS, ES256). The hand-rolled token-endpoint form-POSTs and `internal/jwt` are removed; discovery + JWKS stay leader-resolved (no serving-path IdP I/O). Behaviour is preserved (confidential client, no PKCE yet — that is #36). - go-oidc `NewVerifier(issuer, &StaticKeySet{PublicKeys}, &Config{ClientID: aud, SupportedSigningAlgs: [ES256]})`; x/oauth2 `AuthStyleInParams` keeps `client_id`/`client_secret` in the form body (no Basic-auth probe). - The `justOld` lazy-refresh heuristic is kept (it reads unverified claims, independent of the signature library). Stacked on #33. Part of the public-client + trio effort (spec #31).

ginjiruu added 1 commit

2026-09-16 00:38:30 +00:00

refactor: OIDC Flow uses x/oauth2 + go-oidc (StaticKeySet, ES256) (#34 )

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled