test: 固化 OIDC 校验错误边界

apps/api/internal/auth/oidc_client.go

@@ -2,13 +2,11 @@ package auth
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
-	"strconv"
 	"strings"
 	"sync"
 
@@ -38,12 +36,12 @@ type OIDCTokenResponse struct {
 }
 
 type OIDCPublicClient struct {
-	config       OIDCPublicClientConfig
-	client       *http.Client
-	mu           sync.Mutex
-	oauth2Config *oauth2.Config
-	metadata     oidcClientDiscovery
-	idVerifier   *oidc.IDTokenVerifier
+	config          OIDCPublicClientConfig
+	client          *http.Client
+	mu              sync.Mutex
+	oauth2Config    *oauth2.Config
+	metadata        oidcClientDiscovery
+	idTokenVerifier *oidc.IDTokenVerifier
 }
 
 type oidcClientDiscovery struct {
@@ -122,7 +120,7 @@ func (c *OIDCPublicClient) VerifyIDToken(ctx context.Context, raw, expectedNonce
 		return "", oidcUnauthorized("ID token provider discovery failed", err)
 	}
 	c.mu.Lock()
-	verifier := c.idVerifier
+	verifier := c.idTokenVerifier
 	c.mu.Unlock()
 	if verifier == nil {
 		return "", oidcUnauthorized("ID token verifier is unavailable", nil)
@@ -230,7 +228,7 @@ func (c *OIDCPublicClient) configuration(ctx context.Context) (*oauth2.Config, o
 		Endpoint: endpoint, Scopes: append([]string(nil), c.config.Scopes...),
 	}
 	verifierContext := oidc.ClientContext(context.Background(), c.client)
-	idVerifier := provider.VerifierContext(verifierContext, &oidc.Config{
+	idTokenVerifier := provider.VerifierContext(verifierContext, &oidc.Config{
 		ClientID: c.config.ClientID, SupportedSigningAlgs: []string{oidc.RS256, oidc.ES256},
 	})
 	c.mu.Lock()
@@ -238,7 +236,7 @@ func (c *OIDCPublicClient) configuration(ctx context.Context) (*oauth2.Config, o
 	if c.oauth2Config == nil {
 		c.oauth2Config = config
 		c.metadata = metadata
-		c.idVerifier = idVerifier
+		c.idTokenVerifier = idTokenVerifier
 	}
 	return c.oauth2Config, c.metadata, nil
 }
@@ -267,29 +265,10 @@ func oidcTokenResponse(token *oauth2.Token) (OIDCTokenResponse, error) {
 	idToken, _ := token.Extra("id_token").(string)
 	return OIDCTokenResponse{
 		AccessToken: token.AccessToken, RefreshToken: token.RefreshToken, IDToken: idToken,
-		TokenType: token.TokenType, ExpiresIn: integerTokenExtra(token.Extra("expires_in")),
+		TokenType: token.TokenType, ExpiresIn: int(token.ExpiresIn),
 	}, nil
 }
 
-func integerTokenExtra(value any) int {
-	switch typed := value.(type) {
-	case int:
-		return typed
-	case int64:
-		return int(typed)
-	case float64:
-		return int(typed)
-	case json.Number:
-		result, _ := strconv.Atoi(typed.String())
-		return result
-	case string:
-		result, _ := strconv.Atoi(typed)
-		return result
-	default:
-		return 0
-	}
-}
-
 func validPKCEVerifier(value string) bool {
 	if len(value) < 43 || len(value) > 128 {
 		return false