feat(auth): add fail-closed OIDC provider configuration - #160
Draft
djwhitt wants to merge 11 commits into
Draft
Conversation
Validate role-specific OIDC settings, fetch issuer-pinned discovery and public JWKS documents through bounded Req requests, and start an atomic supervised cache before API or web listeners. Static mode remains unchanged and OIDC requests remain denied until later authentication layers. Includes T-231 configuration reference and adversarial coverage for redirects, response bounds, provider outages, key rotation, secret redaction, and exact claim-value capability mappings.
djwhitt
changed the title
djwhitt
marked this pull request as draft
August 16, 2026 00:09
Carry the updated lower stack and current origin/main into the published provider layer without rewriting existing commits.
T-231 validates that the fetched JWKS contains a usable signing key and moves network refreshes out of the provider GenServer. Failed refreshes are backoff-limited so unavailable providers cannot turn request traffic into serialized outbound retries.
T-231 removes the stale static-only release instruction and points operators to the mode-specific OIDC configuration and rollout guidance.
T-231 rejects duplicate key identifiers and explicit algorithm/key-type mismatches at startup, and terminates any in-flight refresh worker with its provider cache.
Require the browser callback to use the public web host and the fixed /auth/callback route, and add bounded configurable authorization scopes that always include openid. Reject mismatched deployments before the listener starts. Tests: ../bin/x mix ci Tests: ../bin/test Tests: ../bin/x mix dialyzer Refs T-231, T-234, and PL-27.
Keep an optionally configured browser client ID in API OIDC runtime configuration so the token layer can reject ID-token audiences instead of discarding the deployment boundary after validation. Tests: ../bin/test test/smolquery/auth/oidc/config_test.exs Refs T-231, T-232, and PL-27.
Inject the bounded provider HTTP client through role runtimes for deterministic supervision tests. Prove failed discovery prevents both listeners from starting and a provider crash restarts each endpoint subtree under rest_for_one. Tests: ../bin/test test/smolquery_api/supervisor_test.exs test/smolquery_web/supervisor_test.exs Refs T-231 and PL-27.
Publish API and web runtimes from a supervised child placed after the OIDC provider and withdraw them on shutdown. Failed provider startup can no longer leave a persistent runtime for a listener that never started. Refs T-231 and PL-27.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tracker: T-231
Validation
../bin/x mix ci../bin/test../bin/x mix dialyzerStack
Depends on #150. This is layer 3 of stack #151.
Stack managed with GitHub Stacks CLI.