feat(oidc): phase 2 — standard params, ID token claims, logout polish

[lakhansamani]

Summary

OIDC Phase 2 — Standard Parameter Support. Adds 5 OIDC Core §3.1.2.1 authorization request parameters, 3 ID token claims, and polishes the RP-initiated logout flow. All changes are additive and fully backward compatible — no new config flags, no breaking changes.

Implemented via three parallel subagents working on disjoint files, followed by a single holistic end-of-phase review (approved with minor follow-ups, all applied).

Changes

Group A — Logout (RP-Initiated Logout §3)

• Prefers post_logout_redirect_uri (OIDC spec name) over legacy redirect_uri. Both accepted — spec name wins when both supplied.
• Echoes state on the final redirect URL via url.QueryEscape.

Group B — ID token claims (OIDC Core §2)

• auth_time — Unix seconds. New AuthTime field on AuthTokenConfig; defaults to time.Now().Unix() when zero so existing callers work unchanged.
• amr — Authentication Methods Reference. New loginMethodToAMR helper referencing internal/constants:
  • basic_auth / mobile_basic_auth → ["pwd"]
  • magic_link_login / mobile_otp → ["otp"]
  • 10 social providers → ["fed"]
  • unknown / empty → omit
• acr — Hardcoded "0" (minimal assurance). Phase 3 will add MFA-aware ACR alongside acr_values.

All three added to reservedClaims so custom access token scripts cannot forge them.

Group C — /authorize parameters (OIDC Core §3.1.2.1)

• login_hint, ui_locales — URL-escaped and forwarded to the login UI.
• prompt:
  • none → return OIDC error login_required via the client's response mode when no valid session (or session revoked). Proceed silently when valid session exists.
  • login → bypass session cookie, force re-auth.
  • consent / select_account → parsed and logged, no-op.
• max_age:
  • 0 → force re-auth (equivalent to prompt=login).
  • positive → if session older, force re-auth.
  • absent / negative / non-integer → no constraint.
• id_token_hint — parsed and validated structurally. Advisory only per spec; invalid hints logged and ignored.

Critical: prompt=none dispatch correctness

handleResponse could not be reused for prompt=none error responses because it dispatches authentication-required errors to the login UI, which is the opposite of what the OIDC spec requires. A bespoke dispatch is implemented directly in the handler, covering all four response_modes (query, fragment, form_post, web_message). Also catches the case where a session cookie is present but the session has since been revoked.

Backward compatibility

• All new parameters default to "absent" behavior → old clients unaffected.
• New ID token claims are additive → existing consumers unaffected.
• Logout redirect_uri still accepted → existing integrations unaffected.
• No new config flags.
• Default AuthTime=0 falls back to time.Now().Unix() → existing CreateAuthToken callers keep working with no code changes.

Test plan

• TestLogoutPrefersPostLogoutRedirectURI + TestLogoutStateEchoAccepted
• TestIDTokenAuthTimeClaim — explicit echo + default-to-now
• TestIDTokenAmrClaim — 8 table cases
• TestIDTokenAcrClaim — hardcoded "0"
• TestAuthorizePromptNoneNoSessionReturnsLoginRequired
• TestAuthorizeLoginHintForwarded — URL-encoded
• TestAuthorizeUILocalesForwarded
• TestAuthorizePromptConsentAndSelectAccountNoOp
• TestAuthorizeMaxAgeParsedNotRejected
• TestAuthorizeIDTokenHintInvalidIgnored
• TestAuthorizePromptLoginBypassesSession
• Phase 1 regression still green
• Full make test-sqlite green

Commit log

867e58e1 refactor(oidc): phase 2 review follow-ups
f88ede64 feat(oidc): add OIDC Core §3.1.2.1 params to /authorize
50cdc911 feat(oidc): add auth_time, amr, and acr claims to ID token
a20251c3 feat(oidc): logout prefers post_logout_redirect_uri and echoes state

4 commits, +610/-3 across 6 files.

Out of scope / follow-ups

• Phase 3 (pending separate PR): Token Introspection (RFC 7662), hybrid response_types (code id_token, code token, code id_token token), back-channel logout, minimal JWKS multi-key support, MFA-aware acr_values.
• Phase 4 (2027 roadmap): RFC 7591 dynamic client registration, RFC 9101 JAR / Request Object, OIDC Session Management iframe, front-channel logout, automated JWKS key rotation.