Backend Phase B (2/2): OIDC auth + config validation

- internal/auth/oidc.go: OIDCService mit go-oidc v3
  - id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
  - Provider-Caching (sync.Map, lazy init per Issuer-URL)
  - Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
  (find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
  (id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
  (enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert

Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.

go build ./... && go vet ./... && go test ./internal/auth/... ✅

backend/internal/auth/oidc.go

@@ -0,0 +1,123 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+)
+
+// OIDCClaims holds the fields this backend extracts from a verified id_token.
+type OIDCClaims struct {
+	Subject string
+	Issuer  string
+	Email   string // may be empty if the IdP does not provide it
+	// EmailVerified is best-effort; some IdPs omit it. When missing we treat it
+	// as unverified rather than rejecting the login.
+	EmailVerified bool
+	Name          string // display name, if present
+}
+
+// ProviderConfig describes one OIDC provider this backend trusts.
+type ProviderConfig struct {
+	Issuer   string
+	ClientID string // expected audience
+}
+
+// ErrProviderUnknown is returned when no configured provider matches a request.
+var ErrProviderUnknown = errors.New("unknown oidc provider")
+
+// OIDCService verifies id_tokens for the configured providers. Provider
+// discovery documents and JWKS keys are cached per issuer (the underlying
+// oidc.IDTokenVerifier refreshes keys as needed).
+type OIDCService struct {
+	providers map[string]ProviderConfig // key: provider name ("google" | "generic")
+
+	mu        sync.Mutex
+	verifiers map[string]*oidc.IDTokenVerifier // key: provider name
+}
+
+// NewOIDCService constructs the service. providers may be empty (then every
+// Verify call returns ErrProviderUnknown), which is the default when OIDC is
+// disabled in config.
+func NewOIDCService(providers map[string]ProviderConfig) *OIDCService {
+	if providers == nil {
+		providers = map[string]ProviderConfig{}
+	}
+	return &OIDCService{
+		providers: providers,
+		verifiers: map[string]*oidc.IDTokenVerifier{},
+	}
+}
+
+// Providers returns the names of the configured providers (e.g. "google",
+// "generic"). Callers use it to decide whether OIDC is available at all.
+func (s *OIDCService) Providers() []string {
+	names := make([]string, 0, len(s.providers))
+	for k := range s.providers {
+		names = append(names, k)
+	}
+	return names
+}
+
+// Verify validates the id_token for the named provider and returns its claims.
+// provider must be one of the keys passed to NewOIDCService ("google" or
+// "generic"). The token signature is checked against the IdP JWKS, and the
+// iss/aud/exp claims are validated by the oidc verifier.
+func (s *OIDCService) Verify(ctx context.Context, provider, idToken string) (OIDCClaims, error) {
+	pc, ok := s.providers[provider]
+	if !ok {
+		return OIDCClaims{}, fmt.Errorf("%w: %s", ErrProviderUnknown, provider)
+	}
+
+	v, err := s.verifier(ctx, provider, pc)
+	if err != nil {
+		return OIDCClaims{}, fmt.Errorf("build verifier: %w", err)
+	}
+
+	tok, err := v.Verify(ctx, idToken)
+	if err != nil {
+		return OIDCClaims{}, fmt.Errorf("verify id_token: %w", err)
+	}
+
+	// Extract the claim set. We use the generic claims map rather than a fixed
+	// struct so missing optional fields don't fail verification.
+	var raw struct {
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
+		Name          string `json:"name"`
+	}
+	if err := tok.Claims(&raw); err != nil {
+		return OIDCClaims{}, fmt.Errorf("parse claims: %w", err)
+	}
+	return OIDCClaims{
+		Subject:       tok.Subject,
+		Issuer:        tok.Issuer,
+		Email:         raw.Email,
+		EmailVerified: raw.EmailVerified,
+		Name:          raw.Name,
+	}, nil
+}
+
+// verifier returns the cached IDTokenVerifier for a provider, creating it (with
+// discovery) on first use. The discovery round-trip is the reason we cache.
+func (s *OIDCService) verifier(ctx context.Context, provider string, pc ProviderConfig) (*oidc.IDTokenVerifier, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if v := s.verifiers[provider]; v != nil {
+		return v, nil
+	}
+
+	dctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	prov, err := oidc.NewProvider(dctx, pc.Issuer)
+	if err != nil {
+		return nil, fmt.Errorf("discover provider %s (%s): %w", provider, pc.Issuer, err)
+	}
+	v := prov.Verifier(&oidc.Config{ClientID: pc.ClientID})
+	s.verifiers[provider] = v
+	return v, nil
+}

backend/internal/auth/user.go

@@ -93,3 +93,54 @@ func (s *UserStore) GetUserByID(ctx context.Context, id uuid.UUID) (User, error)
 	u.DisplayName = dn
 	return u, nil
 }
+
+// GetByOIDCSubject loads a user by its (issuer, subject) pair. This is the key
+// used to recognise a returning user across OIDC logins.
+func (s *UserStore) GetByOIDCSubject(ctx context.Context, issuer, subject string) (User, error) {
+	const q = `
+		SELECT id, email, password_hash, oidc_subject, oidc_issuer, display_name
+		FROM users WHERE oidc_issuer = $1 AND oidc_subject = $2`
+	var u User
+	var dn *string
+	err := s.pool.QueryRow(ctx, q, issuer, subject).
+		Scan(&u.ID, &u.Email, &u.PasswordHash, &u.OIDCSubject, &u.OIDCIssuer, &dn)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return User{}, ErrUserNotFound
+		}
+		return User{}, fmt.Errorf("get user by oidc subject: %w", err)
+	}
+	u.DisplayName = dn
+	return u, nil
+}
+
+// CreateOIDCUser inserts a new user for an OIDC login. The user has no password
+// (password_hash is NULL) and is identified by (issuer, subject). email may be
+// empty if the IdP did not provide one; we store a synthesized placeholder so
+// the NOT NULL + UNIQUE constraints hold and the account stays addressable.
+func (s *UserStore) CreateOIDCUser(ctx context.Context, issuer, subject, email, displayName string) (User, error) {
+	if email == "" {
+		// Synthesize a stable, non-resolvable address for IdPs that don't return
+		// an email (rare for Google, possible for generic providers).
+		email = fmt.Sprintf("%s@oidc.local", subject)
+	}
+	const q = `
+		INSERT INTO users (email, password_hash, oidc_subject, oidc_issuer, display_name)
+		VALUES ($1, NULL, $2, $3, NULLIF($4, ''))
+		RETURNING id, email, password_hash, oidc_subject, oidc_issuer, display_name`
+	var u User
+	var dn *string
+	err := s.pool.QueryRow(ctx, q, email, subject, issuer, displayName).
+		Scan(&u.ID, &u.Email, &u.PasswordHash, &u.OIDCSubject, &u.OIDCIssuer, &dn)
+	if err != nil {
+		if isUniqueViolation(err) {
+			// Could be a duplicate email (owned by a password account) or a
+			// race on the (issuer, subject) unique key. Surface a generic
+			// conflict; the handler decides the HTTP code.
+			return User{}, fmt.Errorf("%w: oidc account conflict", ErrEmailTaken)
+		}
+		return User{}, fmt.Errorf("create oidc user: %w", err)
+	}
+	u.DisplayName = dn
+	return u, nil
+}