[codex] Fail closed when OIDC HTTP client build fails

[salasebas]

Summary

• make the SSO OIDC HTTP client cache a Result instead of falling back to an unguarded reqwest::Client
• propagate client construction failures through registration, runtime discovery, token exchange, JWKS, and UserInfo paths
• add focused regression coverage proving client-build/cache failures fail closed

Root Cause

Finding 2 identified a fail-open fallback in the SSO OIDC SSRF guard: if the guarded OAuthHttpClient::from_config build failed, RustAuth wrapped a plain reqwest::Client, losing the DNS resolver and redirect policy used to block private/internal targets.

Validation

• cargo fmt --all --check
• cargo test -p rustauth-sso --all-features oidc_http_client
• cargo test -p rustauth-sso --all-features cached_oauth_http_client_failure_is_fail_closed
• cargo nextest run -p rustauth-sso --all-features (338 passed)
• cargo clippy --workspace --all-targets --all-features -- -D warnings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rustauth-docs-site	Ready	Preview, Comment	Jul 1, 2026 6:17am