fix(auth): verify the forced re-authentication instead of only asking for it

Addresses the remaining review findings on this branch. All three come
back to the same gap: the gate was requested but never checked.

## prompt=login was a request with no verification

`prompt=login` asks an IdP to re-authenticate. Nothing confirmed it
obeyed, and `auth_time` appeared nowhere in the codebase. A
non-conforming or misconfigured IdP satisfies the bounce from its own
session, the callback mints a cookie with a fresh `iat`, and the consent
gate passes — the same silent failure this branch exists to prevent, one
level further out.

The bounce now sends `max_age=0` alongside `prompt=login`, which obliges
a conforming IdP to return `auth_time`. `/auth/login` signs the bounce
time into the state cookie as `reauth_at`, so the requirement cannot be
stripped by editing the URL, and `/auth/callback` refuses with 403 —
minting no session — unless the returned `auth_time` postdates it.

A missing `auth_time` is refused as well. Silence is indistinguishable
from a reused session, and this is the only gate between a phished
consent link and a delegated grant. Ordinary logins carry no `reauth_at`
and are untouched; most IdPs omit the claim, and requiring it everywhere
would break every sign-in.

Verifying it meant reading the id_token twice, so the validated decode is
now `_verified_id_token_claims`, shared by the email resolver and the
freshness check. One validated path, so no caller can read a claim out of
an unverified token.

GitHub short-circuits `reauth` at the login route as well as being
refused the grant: it can neither be asked to re-authenticate nor report
that it did, and setting `reauth_at` for it would fail every such login
at the callback instead.

## The mount decision was never exercised through create_app

The factory tests prove the router builds; they never proved the app
calls it. A typo in the mount condition would leave `/oauth/*` absent
under OIDC with the whole suite green — which is exactly the failure the
condition was widened to avoid. `create_app` is now driven directly with
a real OIDC provider (constructed in-process, so no IdP discovery
request), asserting the grant is reachable, and that it is absent for
GitHub. The GitHub case asserts against the route table rather than a
status code: the SPA catch-all answers unmounted paths, so "not 200"
would also pass with the routes mounted and merely erroring.

## A SimpleNamespace config proved nothing about the real cookie

`_session_iat` reads `cookie_config.session_cookie_name` and verifies
with `cookie_config.cookie_secret`. If either diverged from what
`/auth/callback` sets, it would return None on every request and the
consent page would bounce forever — a login loop with no error and no
failing test. A hand-built stub cannot catch that. Added a test that
mints a session through the real `mint_session_cookie` from a real
`OIDCConfig` and asserts the consent page renders, naming the identity
and the client.

## Verified

- 280 tests pass across the auth suite, integration and e2e
- Mutation-checked: dropping the callback verification fails 2 tests,
  treating a missing auth_time as a pass fails 1
- ruff, ruff format, mypy clean

Author: appletechie

designs/DEVICE_AUTH.md

@@ -206,6 +206,16 @@ session. Under accounts that changes nothing — no session means no credential,
 so the form is shown regardless — but under OIDC the caller may still hold a
 live IdP session, and the consent page cannot tell the two cases apart.
 
+**Requested, then verified.** `prompt=login` is only a request, so the bounce
+also sends `max_age=0`, which obliges a conforming IdP to report the moment it
+authenticated the user in the `auth_time` claim. `/auth/login` signs the bounce
+time into the state cookie as `reauth_at`, and `/auth/callback` refuses (403,
+no session minted) unless the returned `auth_time` postdates it. A missing
+`auth_time` is refused too: silence is indistinguishable from a reused session,
+and this gate is the only thing between a phished consent link and a delegated
+grant. Ordinary logins carry no `reauth_at` and are unaffected — most IdPs omit
+the claim, and requiring it everywhere would break every sign-in.
+
 **Why GitHub is excluded.** `OIDCConfig.from_env` accepts GitHub as an `oidc`
 source, but points it at `https://github.com/login/oauth/authorize` — plain
 OAuth 2.0, which has no `prompt` parameter. `prompt=login` would be ignored,

omnigent/server/routes/auth.py

@@ -46,6 +46,8 @@
 _AUTH_STATE_COOKIE_PLAIN = "ap_auth_state"
 _AUTH_STATE_TTL_SECONDS = 300  # 5 minutes
 _CLI_TICKET_TTL_SECONDS = 300  # 5 minutes
+# Tolerance when comparing the IdP's `auth_time` against our own clock.
+_REAUTH_CLOCK_SKEW_SECONDS = 60
 # How long an OIDC invite URL stays redeemable. Matches the accounts
 # provider's default invite window (72h) — long enough to share
 # out-of-band, short enough to bound exposure of an unused link.
@@ -170,8 +172,10 @@ async def login(request: Request) -> Response:
         invite = request.query_params.get("invite") if _invites_enabled else None
         # Forced re-authentication, requested by the device-grant consent page.
         # Without it the IdP satisfies the bounce from its own session and the
-        # consent gate passes on a user who proved nothing.
-        reauth = request.query_params.get("reauth") == "1"
+        # consent gate passes on a user who proved nothing. GitHub OAuth has
+        # no way to demand or report it, so it never gets here — see
+        # `device_auth.unsupported_reason`.
+        reauth = request.query_params.get("reauth") == "1" and config.provider_type != "github"
 
         # Store state + code_verifier in a short-lived signed cookie.
         state_payload: dict[str, str | int] = {
@@ -184,6 +188,10 @@ async def login(request: Request) -> Response:
             state_payload["ticket"] = ticket
         if invite:
             state_payload["invite"] = invite
+        if reauth:
+            # Signed, so the callback's freshness check cannot be removed by
+            # editing the URL.
+            state_payload["reauth_at"] = int(time.time())
         state_jwt = jwt.encode(state_payload, config.cookie_secret, algorithm="HS256")
 
         # Build the authorization URL.
@@ -198,9 +206,10 @@ async def login(request: Request) -> Response:
         }
         if reauth:
             # OIDC Core 3.1.2.1: re-prompt even when the IdP has a session.
-            # Only on this path — as a default it would cost a password on
-            # every sign-in, and get switched off.
+            # `max_age=0` makes it enforceable — it obliges a conforming IdP
+            # to return `auth_time`, which the callback then verifies.
             params["prompt"] = "login"
+            params["max_age"] = "0"
         auth_url = config.authorization_endpoint + "?" + urlencode(params)
 
         response = RedirectResponse(url=auth_url, status_code=302)
@@ -318,6 +327,17 @@ async def callback(request: Request) -> Response:
             else:
                 email = _resolve_oidc_email(token_json, config)
 
+            # This login was demanded by a device-grant consent bounce, so a
+            # session the IdP simply reused is not good enough.
+            reauth_at = state_payload.get("reauth_at")
+            if isinstance(reauth_at, int) and not _reauthenticated_after(
+                token_json, config, reauth_at
+            ):
+                return JSONResponse(
+                    status_code=403,
+                    content={"error": "Re-authentication was required but did not occur"},
+                )
+
         if not email:
             return JSONResponse(
                 status_code=400,
@@ -781,6 +801,84 @@ def _claim_is_verified_true(value: object) -> bool:
     return isinstance(value, str) and value.strip().lower() == "true"
 
 
+def _verified_id_token_claims(
+    token_json: dict[str, object],
+    config: OIDCConfig,
+) -> dict[str, object] | None:
+    """Validate the ``id_token`` and return its claims.
+
+    Checks the JWT signature against the IdP's JWKS and verifies ``iss``
+    and ``aud``. Shared by every consumer so no caller can read a claim out
+    of an unverified token.
+
+    :param token_json: The token endpoint response JSON.
+    :param config: The OIDC configuration with JWKS URI and expected
+        issuer/audience.
+    :returns: The verified claims, or ``None`` when the token is missing,
+        unverifiable, or the config has no JWKS URI.
+    """
+    id_token = token_json.get("id_token")
+    if not isinstance(id_token, str) or not id_token:
+        return None
+    if config.jwks_uri is None:
+        _logger.warning("Rejecting id_token: OIDC configuration has no JWKS URI")
+        return None
+
+    try:
+        jwks_client = jwt.PyJWKClient(config.jwks_uri)
+        signing_key = jwks_client.get_signing_key_from_jwt(id_token)
+        claims: dict[str, object] = jwt.decode(
+            id_token,
+            signing_key.key,
+            algorithms=["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"],
+            audience=config.client_id,
+            issuer=config.issuer,
+        )
+    except jwt.InvalidTokenError as exc:
+        _logger.warning("id_token validation failed: %s", exc)
+        return None
+
+    return claims
+
+
+def _reauthenticated_after(
+    token_json: dict[str, object],
+    config: OIDCConfig,
+    not_before: int,
+) -> bool:
+    """Did the IdP actually re-authenticate the user for this login?
+
+    ``prompt=login`` and ``max_age=0`` are requests. This is the check that
+    they were honoured: a conforming IdP that re-authenticates must report
+    when it did, via the ``auth_time`` claim, and that moment has to fall
+    after the bounce that demanded it.
+
+    Fails closed. A missing ``auth_time`` means the IdP did not answer the
+    question, which is indistinguishable from it having reused an existing
+    session — and this is the only gate standing between a phished consent
+    link and a delegated grant.
+
+    :param token_json: The token endpoint response JSON.
+    :param config: The OIDC configuration.
+    :param not_before: Epoch seconds the re-authentication must postdate.
+    :returns: True only on a proven fresh authentication.
+    """
+    claims = _verified_id_token_claims(token_json, config)
+    if claims is None:
+        return False
+
+    auth_time = claims.get("auth_time")
+    if not isinstance(auth_time, int):
+        _logger.warning(
+            "Forced re-authentication could not be verified: the id_token has no "
+            "integer auth_time claim, so the IdP may have reused an existing session"
+        )
+        return False
+
+    # Small tolerance for clock skew between us and the IdP.
+    return auth_time >= not_before - _REAUTH_CLOCK_SKEW_SECONDS
+
+
 def _resolve_oidc_email(
     token_json: dict[str, object],
     config: OIDCConfig,
@@ -819,25 +917,8 @@ def _resolve_oidc_email(
         ``email_verified`` is not truthy (and verification is not
         skipped via config).
     """
-    id_token = token_json.get("id_token")
-    if not isinstance(id_token, str) or not id_token:
-        return None
-    if config.jwks_uri is None:
-        _logger.warning("Rejecting id_token: OIDC configuration has no JWKS URI")
-        return None
-
-    try:
-        jwks_client = jwt.PyJWKClient(config.jwks_uri)
-        signing_key = jwks_client.get_signing_key_from_jwt(id_token)
-        claims = jwt.decode(
-            id_token,
-            signing_key.key,
-            algorithms=["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"],
-            audience=config.client_id,
-            issuer=config.issuer,
-        )
-    except jwt.InvalidTokenError as exc:
-        _logger.warning("id_token validation failed: %s", exc)
+    claims = _verified_id_token_claims(token_json, config)
+    if claims is None:
         return None
 
     email = claims.get(config.email_claim)

tests/server/test_device_auth.py

@@ -341,6 +341,126 @@ def _build_accounts_app(
         yield client
 
 
+def _build_oidc_app(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    provider_type: str = "oidc",
+) -> Iterator[TestClient]:
+    """Build a real app through ``create_app`` with an OIDC auth provider.
+
+    The provider is constructed directly rather than through
+    ``create_auth_provider`` so no IdP discovery request is made; everything
+    downstream — including the device-grant mount decision — is the
+    production path.
+    """
+    monkeypatch.setenv("OMNIGENT_DEVICE_GRANT_ENABLED", "1")
+    monkeypatch.delenv("OMNIGENT_AUTH_PROVIDER", raising=False)
+
+    db_url = f"sqlite:///{tmp_path}/test.db"
+    from omnigent.db.utils import get_or_create_engine
+    from omnigent.runtime import init as init_runtime
+    from omnigent.runtime import telemetry
+    from omnigent.runtime.agent_cache import AgentCache
+    from omnigent.runtime.caps import RuntimeCaps
+    from omnigent.server.app import create_app
+    from omnigent.server.auth import UnifiedAuthProvider
+    from omnigent.server.oidc import OIDCConfig
+    from omnigent.stores.agent_store.sqlalchemy_store import SqlAlchemyAgentStore
+    from omnigent.stores.artifact_store.local import LocalArtifactStore
+    from omnigent.stores.comment_store.sqlalchemy_store import SqlAlchemyCommentStore
+    from omnigent.stores.conversation_store.sqlalchemy_store import SqlAlchemyConversationStore
+    from omnigent.stores.file_store.sqlalchemy_store import SqlAlchemyFileStore
+    from omnigent.stores.host_store import HostStore
+    from omnigent.stores.permission_store.sqlalchemy_store import SqlAlchemyPermissionStore
+
+    get_or_create_engine(db_url)
+    telemetry.init()
+    permission_store = SqlAlchemyPermissionStore(db_url)
+    agent_store = SqlAlchemyAgentStore(db_url)
+    conversation_store = SqlAlchemyConversationStore(db_url)
+    file_store = SqlAlchemyFileStore(db_url)
+    comment_store = SqlAlchemyCommentStore(db_url)
+    host_store = HostStore(db_url)
+    artifact_store = LocalArtifactStore(str(tmp_path / "artifacts"))
+    agent_cache = AgentCache(artifact_store=artifact_store, cache_dir=tmp_path / "cache")
+    init_runtime(
+        agent_cache=agent_cache,
+        caps=RuntimeCaps(),
+        agent_store=agent_store,
+        file_store=file_store,
+        conversation_store=conversation_store,
+        artifact_store=artifact_store,
+        comment_store=comment_store,
+    )
+
+    config = OIDCConfig(
+        issuer="https://accounts.google.com",
+        client_id="cid",
+        client_secret="secret",
+        redirect_uri="http://localhost:8000/auth/callback",
+        cookie_secret=bytes.fromhex("bb" * 32),
+        scopes="openid email profile",
+        session_ttl_hours=8,
+        logout_redirect_uri=None,
+        allowed_domains=None,
+        provider_type=provider_type,
+        authorization_endpoint="https://accounts.google.com/o/oauth2/v2/auth",
+        token_endpoint="https://oauth2.googleapis.com/token",
+        jwks_uri="https://www.googleapis.com/oauth2/v3/certs",
+        userinfo_endpoint=None,
+        allow_invites=False,
+    )
+    app = create_app(
+        agent_store=agent_store,
+        file_store=file_store,
+        conversation_store=conversation_store,
+        artifact_store=artifact_store,
+        agent_cache=agent_cache,
+        comment_store=comment_store,
+        permission_store=permission_store,
+        host_store=host_store,
+        auth_provider=UnifiedAuthProvider(source="oidc", oidc_config=config),
+    )
+    with TestClient(app) as client:
+        yield client
+
+
+def test_create_app_mounts_the_grant_under_oidc(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The mount decision must be exercised through ``create_app`` itself.
+
+    Testing the factory directly proves the router builds; it does not prove
+    the app ever calls it. A typo in the mount condition would silently leave
+    ``/oauth/*`` absent under OIDC with every other test still green.
+    """
+    for client in _build_oidc_app(tmp_path, monkeypatch):
+        res = client.post("/oauth/device/authorize", json={"client_id": "polly"})
+        assert res.status_code == 200, f"/oauth/device/authorize returned {res.status_code}"
+        assert res.json()["user_code"]
+
+
+def test_create_app_refuses_the_grant_for_github_oauth(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """GitHub is an ``oidc`` source that cannot honour the re-auth gate.
+
+    The app must boot without it rather than mount routes whose security
+    property does not hold.
+    """
+    for client in _build_oidc_app(tmp_path, monkeypatch, provider_type="github"):
+        # Asserted against the route table, not a status code: the SPA
+        # catch-all answers unmounted paths, so "not 200" would also pass if
+        # the routes were mounted and merely erroring.
+        oauth_routes = [
+            route.path
+            for route in client.app.routes  # type: ignore[attr-defined]
+            if getattr(route, "path", "").startswith("/oauth/")
+        ]
+        assert oauth_routes == [], f"the grant must not mount for GitHub OAuth: {oauth_routes}"
+
+
 @pytest.fixture
 def app(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[TestClient]:
     yield from _build_accounts_app(tmp_path, monkeypatch)