mitbringsl/backend/internal/auth/oidc.go

package auth

import (
	"context"
	"errors"
	"fmt"
	"sync"
	"time"

	"github.com/coreos/go-oidc/v3/oidc"
)

// OIDCClaims holds the fields this backend extracts from a verified id_token.
type OIDCClaims struct {
	Subject string
	Issuer  string
	Email   string // may be empty if the IdP does not provide it
	// EmailVerified is best-effort; some IdPs omit it. When missing we treat it
	// as unverified rather than rejecting the login.
	EmailVerified bool
	Name          string // display name, if present
}

// ProviderConfig describes one OIDC provider this backend trusts.
type ProviderConfig struct {
	Issuer   string
	ClientID string // expected audience
}

// ErrProviderUnknown is returned when no configured provider matches a request.
var ErrProviderUnknown = errors.New("unknown oidc provider")

// OIDCService verifies id_tokens for the configured providers. Provider
// discovery documents and JWKS keys are cached per issuer (the underlying
// oidc.IDTokenVerifier refreshes keys as needed).
type OIDCService struct {
	providers map[string]ProviderConfig // key: provider name ("google" | "generic")

	mu        sync.Mutex
	verifiers map[string]*oidc.IDTokenVerifier // key: provider name
}

// NewOIDCService constructs the service. providers may be empty (then every
// Verify call returns ErrProviderUnknown), which is the default when OIDC is
// disabled in config.
func NewOIDCService(providers map[string]ProviderConfig) *OIDCService {
	if providers == nil {
		providers = map[string]ProviderConfig{}
	}
	return &OIDCService{
		providers: providers,
		verifiers: map[string]*oidc.IDTokenVerifier{},
	}
}

// Providers returns the names of the configured providers (e.g. "google",
// "generic"). Callers use it to decide whether OIDC is available at all.
func (s *OIDCService) Providers() []string {
	names := make([]string, 0, len(s.providers))
	for k := range s.providers {
		names = append(names, k)
	}
	return names
}

// Verify validates the id_token for the named provider and returns its claims.
// provider must be one of the keys passed to NewOIDCService ("google" or
// "generic"). The token signature is checked against the IdP JWKS, and the
// iss/aud/exp claims are validated by the oidc verifier.
func (s *OIDCService) Verify(ctx context.Context, provider, idToken string) (OIDCClaims, error) {
	pc, ok := s.providers[provider]
	if !ok {
		return OIDCClaims{}, fmt.Errorf("%w: %s", ErrProviderUnknown, provider)
	}

	v, err := s.verifier(ctx, provider, pc)
	if err != nil {
		return OIDCClaims{}, fmt.Errorf("build verifier: %w", err)
	}

	tok, err := v.Verify(ctx, idToken)
	if err != nil {
		return OIDCClaims{}, fmt.Errorf("verify id_token: %w", err)
	}

	// Extract the claim set. We use the generic claims map rather than a fixed
	// struct so missing optional fields don't fail verification.
	var raw struct {
		Email         string `json:"email"`
		EmailVerified bool   `json:"email_verified"`
		Name          string `json:"name"`
	}
	if err := tok.Claims(&raw); err != nil {
		return OIDCClaims{}, fmt.Errorf("parse claims: %w", err)
	}
	return OIDCClaims{
		Subject:       tok.Subject,
		Issuer:        tok.Issuer,
		Email:         raw.Email,
		EmailVerified: raw.EmailVerified,
		Name:          raw.Name,
	}, nil
}

// verifier returns the cached IDTokenVerifier for a provider, creating it (with
// discovery) on first use. The discovery round-trip is the reason we cache.
func (s *OIDCService) verifier(ctx context.Context, provider string, pc ProviderConfig) (*oidc.IDTokenVerifier, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	if v := s.verifiers[provider]; v != nil {
		return v, nil
	}

	dctx, cancel := context.WithTimeout(ctx, 10*time.Second)
	defer cancel()
	prov, err := oidc.NewProvider(dctx, pc.Issuer)
	if err != nil {
		return nil, fmt.Errorf("discover provider %s (%s): %w", provider, pc.Issuer, err)
	}
	v := prov.Verifier(&oidc.Config{ClientID: pc.ClientID})
	s.verifiers[provider] = v
	return v, nil
}