feat(auth): add browser OIDC authorization-code login - #163
Draft
djwhitt wants to merge 10 commits into
Draft
Conversation
Add fail-closed browser login and callback handling with explicit state, nonce, S256 PKCE, bounded Req token exchange, strict ID-token verification, and encrypted minimal sessions. Sessions are portable across web nodes, renewed at login, bounded by assertion expiry, and guarded by a temporary all-capabilities fence until route and event authorization lands. Provide CSRF-protected local logout and preserve static Basic authentication.
djwhitt
changed the title
djwhitt
marked this pull request as draft
August 16, 2026 00:09
Carry the hardened provider cache, separated token profiles, updated lower stack, and current origin/main into the published browser-login layer without rewriting existing commits.
T-234 carries the validated exp-plus-skew boundary into the web auth context so a freshly accepted ID token is not rejected immediately by policy.
T-234 stores a bounded set of short-lived browser authorization transactions, consumes only the matching state before exchange, and preserves unrelated tabs when a callback is stale or forged.
Propagate the provider key-set and refresh-worker lifecycle fixes through the published browser-login layer without rewriting existing commits.
T-234 removes the matching browser transaction when the provider returns an error callback, while preserving unrelated login attempts and the generic failure response.
Propagate the lower-stack callback, host, and scope validation into the browser-login layer without rewriting existing commits.
Store each state, nonce, and PKCE verifier in an independently named encrypted auth-path cookie so concurrent login and callback responses cannot overwrite or restore another transaction. Request configured browser scopes and expose a CSRF-protected OIDC logout control that clears identity and pending transactions. Tests: ../bin/x mix ci Tests: ../bin/test Tests: ../bin/x mix dialyzer Refs T-234 and PL-27.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tracker: T-234
Validation
../bin/x mix ci../bin/test../bin/x mix dialyzerStack
Depends on #162. This is layer 6 of stack #151.
Stack managed with GitHub Stacks CLI.