feat(iam): Implement OIDC discovery and JWKS-based JWT validation

[Copilot]

OIDCProvider was a stub that only validated config JSON — no discovery, no JWKS fetch, no token verification. This replaces it with a full OIDC implementation.

Core changes

• OIDCConfig — adds optional jwks_url and discovery_url for non-standard providers
• OIDCProvider — adds injectable HTTPClient (defaults to http.DefaultClient) and thread-safe in-memory caches (1-hour TTL) for discovery docs and JWKS keys
• OIDC discovery — discover() fetches {issuer}/.well-known/openid-configuration; result is cached per issuer
• JWKS / JWT validation — fetches and caches RSA public keys; keyFunc auto-refreshes on unknown kid to handle key rotation; validates RS256/384/512 signatures plus iss, aud, exp, iat claims
• ResolveIdentities() — when id_token is present in credentials, performs full JWT validation and extracts the configured claim; falls back to direct claim extraction otherwise (backward-compatible)
• TestConnection() — performs real OIDC discovery and verifies JWKS reachability instead of just parsing config JSON

Example

// Wire up a real OIDC provider with an injectable client for testing
p := &OIDCProvider{HTTPClient: testServer.Client()}

cfg, _ := json.Marshal(OIDCConfig{
    Issuer:   "https://auth.example.com",
    ClientID: "my-app",
    ClaimKey: "email",
})

ids, err := p.ResolveIdentities(ctx, cfg, map[string]string{
    "id_token": "eyJhbGci...", // validated against JWKS
})

Tests (iam/oidc_test.go)

Uses httptest.NewServer with in-process RSA key generation to cover: valid token, custom claim, expired token, wrong audience/issuer, invalid signature, JWKS key rotation, and TestConnection success/failure.

Original prompt

Problem

The iam/oidc.go file contains an OIDCProvider struct that is a stub — it validates the configuration JSON format but performs no actual OIDC operations: no discovery, no JWKS fetching, no JWT signature verification, no token validation.

Current Code

// iam/oidc.go

// OIDCProvider maps OIDC claims to roles.
// This is a stub implementation that validates config format but does not make
// actual OIDC discovery or token validation calls.
type OIDCProvider struct{}

func (p *OIDCProvider) ValidateConfig(config json.RawMessage) error {
    var c OIDCConfig
    if err := json.Unmarshal(config, &c); err != nil {
        return fmt.Errorf("invalid oidc config: %w", err)
    }
    if c.Issuer == "" {
        return fmt.Errorf("issuer is required")
    }
    if c.ClientID == "" {
        return fmt.Errorf("client_id is required")
    }
    return nil
}

func (p *OIDCProvider) ResolveIdentities(_ context.Context, config json.RawMessage, credentials map[string]string) ([]ExternalIdentity, error) {
    // ... extracts claim from credentials map directly, no token validation
}

func (p *OIDCProvider) TestConnection(_ context.Context, config json.RawMessage) error {
    return p.ValidateConfig(config) // Just validates JSON format, no network call
}

Requirements

1. Add OIDC/JWKS dependencies: github.com/MicahParks/keyfunc/v2 (for JWKS) and github.com/golang-jwt/jwt/v5 (for JWT parsing). Alternatively, use github.com/coreos/go-oidc/v3 which provides a complete OIDC client.

2. Implement OIDC Discovery in TestConnection() and/or a new Discover() method:

   • Fetch {issuer}/.well-known/openid-configuration.
   • Parse the discovery document to extract jwks_uri, authorization_endpoint, token_endpoint, userinfo_endpoint.
   • Cache the discovery document for a configurable TTL (e.g., 1 hour).

3. Implement JWKS-based token validation in ResolveIdentities():

   • Fetch the JWKS from jwks_uri discovered above.
   • Cache the JWKS with automatic refresh on key rotation.
   • Parse and validate the JWT id_token:
     • Verify signature against JWKS.
     • Verify iss matches the configured issuer.
     • Verify aud contains the configured client_id.
     • Verify exp is not in the past.
     • Verify iat is not too far in the future.
   • Extract claims and return ExternalIdentity with the configured claim_key value.

4. Implement TestConnection() properly:

   • Perform actual OIDC discovery (fetch .well-known/openid-configuration).
   • Verify the JWKS endpoint is reachable.
   • Return an error if discovery fails or JWKS is unreachable.

5. Make the HTTP client injectable for testing:

   • Accept an *http.Client or HTTPClient interface so tests can use httptest.NewServer.

6. Update OIDCConfig if needed:

   type OIDCConfig struct {
       Issuer   string `json:"issuer"`
       ClientID string `json:"client_id"`
       ClaimKey string `json:"claim_key"`
       // Optional: for non-standard providers
       JWKSURL          string `json:"jwks_url,omitempty"`
       DiscoveryURL     string `json:"discovery_url,omitempty"`
   }

7. Remove the stub label from the struct comment.

8. Write tests in iam/oidc_test.go:

   • Use httptest.NewServer to mock the OIDC discovery and JWKS endpoints.
   • Generate test RSA keys, create a JWKS document, and sign test JWTs.
   • Test successful token validation with valid JWT.
   • Test rejection of expired tokens.
   • Test rejection of tokens with wrong audience.
   • Test rejection of tokens with wrong issuer.
   • Test rejection of tokens with invalid signature.
   • Test TestConnection with valid and invalid discovery endpoints.
   • Test JWKS key rotation (new key ID works after refresh).

9. Ensure all existing tests pass (go test ./...).

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.