refactor: 使用 go-oidc 验证 ID Token

apps/api/internal/httpapi/oidc_session.go

@@ -117,7 +117,7 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 		s.writeOIDCCallbackError(w, r, http.StatusUnauthorized, "认证中心访问令牌校验失败", errorCodeOIDCTokenExchangeFailed)
 		return
 	}
-	idSubject, err := s.auth.OIDCVerifier.VerifyIDToken(r.Context(), tokens.IDToken, s.cfg.OIDCClientID, transaction.Nonce)
+	idSubject, err := s.oidcClient.VerifyIDToken(r.Context(), tokens.IDToken, transaction.Nonce)
 	if err != nil || idSubject != identity.ID {
 		s.writeOIDCCallbackError(w, r, http.StatusUnauthorized, "认证中心身份令牌校验失败", errorCodeOIDCTokenExchangeFailed)
 		return

apps/api/internal/httpapi/oidc_session_test.go

@@ -204,6 +204,9 @@ func (f *fakeOIDCClient) AuthorizationURL(_ context.Context, state, nonce, chall
 func (f *fakeOIDCClient) ExchangeCode(context.Context, string, string) (auth.OIDCTokenResponse, error) {
 	return auth.OIDCTokenResponse{}, nil
 }
+func (f *fakeOIDCClient) VerifyIDToken(context.Context, string, string) (string, error) {
+	return "", nil
+}
 func (f *fakeOIDCClient) Refresh(context.Context, string) (auth.OIDCTokenResponse, error) {
 	return auth.OIDCTokenResponse{}, nil
 }

apps/api/internal/httpapi/server.go

@@ -33,6 +33,7 @@ type Server struct {
 type oidcPublicClient interface {
 	AuthorizationURL(context.Context, string, string, string) (string, error)
 	ExchangeCode(context.Context, string, string) (auth.OIDCTokenResponse, error)
+	VerifyIDToken(context.Context, string, string) (string, error)
 	Refresh(context.Context, string) (auth.OIDCTokenResponse, error)
 	RevokeRefreshToken(context.Context, string) error
 	EndSessionURL(context.Context, string) (string, error)