feat: 实现 OIDC 服务端会话与请求刷新

使用 AES-256-GCM 保存认证中心令牌，并以随机 Cookie 哈希关联 PostgreSQL 会话。加入闲置与绝对期限、Refresh Token 轮换以及多实例刷新锁。

apps/api/internal/auth/auth.go

@@ -58,6 +58,18 @@ const userContextKey contextKey = "easyai-auth-user"
 
 var ErrUnauthorized = errors.New("unauthorized")
 
+type RequestAuthError struct {
+	Status  int
+	Code    string
+	Message string
+}
+
+func (e *RequestAuthError) Error() string { return e.Code }
+
+func NewRequestAuthError(status int, code, message string) error {
+	return &RequestAuthError{Status: status, Code: code, Message: message}
+}
+
 type Authenticator struct {
 	JWTSecret                string
 	ServerMainBaseURL        string
@@ -67,6 +79,7 @@ type Authenticator struct {
 	HTTPClient               *http.Client
 	LocalAPIKeyVerifier      func(ctx context.Context, apiKey string) (*User, error)
 	OIDCVerifier             *OIDCVerifier
+	OIDCSessionResolver      func(ctx context.Context, sessionID string) (*User, error)
 	LegacyJWTEnabled         bool
 }
 
@@ -95,13 +108,23 @@ func (a *Authenticator) Require(permission Permission, next http.Handler) http.H
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		user, err := a.Authenticate(r)
 		if err != nil {
-			if strings.HasPrefix(err.Error(), ErrUnauthorized.Error()+":") {
-				slog.WarnContext(r.Context(), "OIDC authentication rejected", "reason", err.Error())
-			}
 			if permission == PermissionPublic {
 				next.ServeHTTP(w, r)
 				return
 			}
+			var requestError *RequestAuthError
+			if errors.As(err, &requestError) {
+				w.Header().Set("Content-Type", "application/json; charset=utf-8")
+				w.Header().Set("Cache-Control", "no-store")
+				w.WriteHeader(requestError.Status)
+				_ = json.NewEncoder(w).Encode(map[string]any{"error": map[string]any{
+					"message": requestError.Message, "status": requestError.Status, "code": requestError.Code,
+				}})
+				return
+			}
+			if strings.HasPrefix(err.Error(), ErrUnauthorized.Error()+":") {
+				slog.WarnContext(r.Context(), "OIDC authentication rejected", "reason", err.Error())
+			}
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
@@ -115,7 +138,6 @@ func (a *Authenticator) Require(permission Permission, next http.Handler) http.H
 
 func (a *Authenticator) Authenticate(r *http.Request) (*User, error) {
 	token := extractBearer(r.Header.Get("Authorization"))
-	fromOIDCSessionCookie := false
 	if token == "" {
 		token = strings.TrimSpace(r.Header.Get("x-comfy-api-key"))
 	}
@@ -127,16 +149,16 @@ func (a *Authenticator) Authenticate(r *http.Request) (*User, error) {
 	}
 	if token == "" {
 		if cookie, err := r.Cookie(OIDCSessionCookieName); err == nil {
-			token = strings.TrimSpace(cookie.Value)
-			fromOIDCSessionCookie = token != ""
+			sessionID := strings.TrimSpace(cookie.Value)
+			if sessionID == "" || a.OIDCSessionResolver == nil {
+				return nil, ErrUnauthorized
+			}
+			return a.OIDCSessionResolver(r.Context(), sessionID)
 		}
 	}
 	if token == "" {
 		return nil, ErrUnauthorized
 	}
-	if fromOIDCSessionCookie && jwtAlgorithm(token) != "RS256" && jwtAlgorithm(token) != "ES256" {
-		return nil, ErrUnauthorized
-	}
 	if strings.HasPrefix(token, "sk-") {
 		return a.verifyAPIKey(r.Context(), token)
 	}

apps/api/internal/auth/oidc.go

@@ -21,6 +21,7 @@ import (
 )
 
 const maxOIDCResponseBytes = 1 << 20
+const defaultOIDCHTTPTimeout = 10 * time.Second
 
 type OIDCConfig struct {
 	Issuer                    string
@@ -82,7 +83,7 @@ func NewOIDCVerifier(config OIDCConfig) (*OIDCVerifier, error) {
 	}
 	client := config.HTTPClient
 	if client == nil {
-		client = &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+		client = &http.Client{Timeout: defaultOIDCHTTPTimeout, CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
 			return http.ErrUseLastResponse
 		}}
 	}
@@ -151,6 +152,45 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 	}, nil
 }
 
+func (v *OIDCVerifier) VerifyIDToken(ctx context.Context, raw, clientID, expectedNonce string) (string, error) {
+	clientID = strings.TrimSpace(clientID)
+	expectedNonce = strings.TrimSpace(expectedNonce)
+	if clientID == "" || expectedNonce == "" {
+		return "", oidcUnauthorized("ID token validation context is invalid", nil)
+	}
+	parser := jwt.NewParser(jwt.WithValidMethods([]string{"RS256", "ES256"}))
+	unverified, _, err := parser.ParseUnverified(raw, jwt.MapClaims{})
+	if err != nil || unverified == nil {
+		return "", oidcUnauthorized("ID token envelope is invalid", err)
+	}
+	kid, _ := unverified.Header["kid"].(string)
+	if kid == "" {
+		return "", oidcUnauthorized("ID token kid is missing", nil)
+	}
+	key, err := v.key(ctx, kid)
+	if err != nil {
+		return "", oidcUnauthorized("ID token signing key lookup failed", err)
+	}
+	token, err := jwt.Parse(raw, func(token *jwt.Token) (any, error) {
+		if token.Header["kid"] != kid {
+			return nil, ErrUnauthorized
+		}
+		return key, nil
+	}, jwt.WithValidMethods([]string{"RS256", "ES256"}), jwt.WithIssuer(v.config.Issuer),
+		jwt.WithAudience(clientID), jwt.WithExpirationRequired(), jwt.WithLeeway(30*time.Second))
+	if err != nil || !token.Valid {
+		return "", oidcUnauthorized("ID token signature or registered claims are invalid", err)
+	}
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok || stringClaim(claims, "sub") == "" || stringClaim(claims, "nonce") != expectedNonce {
+		return "", oidcUnauthorized("ID token subject or nonce is invalid", nil)
+	}
+	if _, ok := numericDateClaim(claims["nbf"]); !ok {
+		return "", oidcUnauthorized("ID token nbf is missing", nil)
+	}
+	return stringClaim(claims, "sub"), nil
+}
+
 func oidcUnauthorized(reason string, cause error) error {
 	if cause != nil {
 		return fmt.Errorf("%w: %s: %v", ErrUnauthorized, reason, cause)

apps/api/internal/auth/oidc_client.go

@@ -0,0 +1,249 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+)
+
+var ErrOIDCInvalidGrant = errors.New("OIDC refresh token is invalid")
+
+type OIDCPublicClientConfig struct {
+	Issuer                string
+	ClientID              string
+	RedirectURI           string
+	PostLogoutRedirectURI string
+	Scopes                []string
+	HTTPClient            *http.Client
+}
+
+type OIDCTokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+	IDToken      string `json:"id_token"`
+	TokenType    string `json:"token_type"`
+	ExpiresIn    int    `json:"expires_in"`
+}
+
+type OIDCPublicClient struct {
+	config   OIDCPublicClientConfig
+	client   *http.Client
+	mu       sync.Mutex
+	metadata oidcClientDiscovery
+}
+
+type oidcClientDiscovery struct {
+	Issuer                string `json:"issuer"`
+	AuthorizationEndpoint string `json:"authorization_endpoint"`
+	TokenEndpoint         string `json:"token_endpoint"`
+	RevocationEndpoint    string `json:"revocation_endpoint"`
+	EndSessionEndpoint    string `json:"end_session_endpoint"`
+}
+
+func NewOIDCPublicClient(config OIDCPublicClientConfig) (*OIDCPublicClient, error) {
+	config.Issuer = strings.TrimRight(strings.TrimSpace(config.Issuer), "/")
+	config.ClientID = strings.TrimSpace(config.ClientID)
+	config.RedirectURI = strings.TrimSpace(config.RedirectURI)
+	config.PostLogoutRedirectURI = strings.TrimSpace(config.PostLogoutRedirectURI)
+	config.Scopes = normalizedScopes(config.Scopes)
+	for _, scope := range config.Scopes {
+		if strings.EqualFold(scope, "offline_access") {
+			return nil, errors.New("offline_access is not allowed for Gateway browser sessions")
+		}
+	}
+	if validatePublicURL(config.Issuer) != nil || config.ClientID == "" || validatePublicURL(config.RedirectURI) != nil || validatePublicURL(config.PostLogoutRedirectURI) != nil {
+		return nil, errors.New("issuer, public client id and exact redirect URLs are required")
+	}
+	client := config.HTTPClient
+	if client == nil {
+		client = &http.Client{Timeout: defaultOIDCHTTPTimeout, CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+			return http.ErrUseLastResponse
+		}}
+	}
+	return &OIDCPublicClient{config: config, client: client}, nil
+}
+
+func (c *OIDCPublicClient) AuthorizationURL(ctx context.Context, state, nonce, codeChallenge string) (string, error) {
+	if strings.TrimSpace(state) == "" || strings.TrimSpace(nonce) == "" || strings.TrimSpace(codeChallenge) == "" {
+		return "", errors.New("state, nonce and PKCE challenge are required")
+	}
+	metadata, err := c.discovery(ctx)
+	if err != nil {
+		return "", err
+	}
+	parsed, err := url.Parse(metadata.AuthorizationEndpoint)
+	if err != nil {
+		return "", errors.New("OIDC authorization endpoint is invalid")
+	}
+	query := parsed.Query()
+	query.Set("response_type", "code")
+	query.Set("client_id", c.config.ClientID)
+	query.Set("redirect_uri", c.config.RedirectURI)
+	query.Set("scope", strings.Join(c.config.Scopes, " "))
+	query.Set("state", state)
+	query.Set("nonce", nonce)
+	query.Set("code_challenge", codeChallenge)
+	query.Set("code_challenge_method", "S256")
+	parsed.RawQuery = query.Encode()
+	return parsed.String(), nil
+}
+
+func (c *OIDCPublicClient) ExchangeCode(ctx context.Context, code, verifier string) (OIDCTokenResponse, error) {
+	if strings.TrimSpace(code) == "" || strings.TrimSpace(verifier) == "" {
+		return OIDCTokenResponse{}, errors.New("authorization code and PKCE verifier are required")
+	}
+	return c.token(ctx, url.Values{
+		"grant_type": {"authorization_code"}, "client_id": {c.config.ClientID},
+		"redirect_uri": {c.config.RedirectURI}, "code": {code}, "code_verifier": {verifier},
+	})
+}
+
+func (c *OIDCPublicClient) Refresh(ctx context.Context, refreshToken string) (OIDCTokenResponse, error) {
+	if strings.TrimSpace(refreshToken) == "" {
+		return OIDCTokenResponse{}, ErrOIDCInvalidGrant
+	}
+	return c.token(ctx, url.Values{
+		"grant_type": {"refresh_token"}, "client_id": {c.config.ClientID}, "refresh_token": {refreshToken},
+	})
+}
+
+func (c *OIDCPublicClient) RevokeRefreshToken(ctx context.Context, refreshToken string) error {
+	if strings.TrimSpace(refreshToken) == "" {
+		return nil
+	}
+	metadata, err := c.discovery(ctx)
+	if err != nil {
+		return err
+	}
+	if metadata.RevocationEndpoint == "" {
+		return errors.New("OIDC revocation endpoint is unavailable")
+	}
+	response, err := c.postForm(ctx, metadata.RevocationEndpoint, url.Values{
+		"client_id": {c.config.ClientID}, "token": {refreshToken}, "token_type_hint": {"refresh_token"},
+	})
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, maxOIDCResponseBytes))
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("OIDC revocation returned HTTP %d", response.StatusCode)
+	}
+	return nil
+}
+
+func (c *OIDCPublicClient) EndSessionURL(ctx context.Context, idTokenHint string) (string, error) {
+	metadata, err := c.discovery(ctx)
+	if err != nil {
+		return "", err
+	}
+	if metadata.EndSessionEndpoint == "" {
+		return c.config.PostLogoutRedirectURI, nil
+	}
+	parsed, err := url.Parse(metadata.EndSessionEndpoint)
+	if err != nil {
+		return "", errors.New("OIDC end session endpoint is invalid")
+	}
+	query := parsed.Query()
+	query.Set("client_id", c.config.ClientID)
+	query.Set("post_logout_redirect_uri", c.config.PostLogoutRedirectURI)
+	if strings.TrimSpace(idTokenHint) != "" {
+		query.Set("id_token_hint", idTokenHint)
+	}
+	parsed.RawQuery = query.Encode()
+	return parsed.String(), nil
+}
+
+func (c *OIDCPublicClient) token(ctx context.Context, form url.Values) (OIDCTokenResponse, error) {
+	metadata, err := c.discovery(ctx)
+	if err != nil {
+		return OIDCTokenResponse{}, err
+	}
+	response, err := c.postForm(ctx, metadata.TokenEndpoint, form)
+	if err != nil {
+		return OIDCTokenResponse{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		var oauthError struct {
+			Error string `json:"error"`
+		}
+		_ = json.NewDecoder(io.LimitReader(response.Body, maxOIDCResponseBytes)).Decode(&oauthError)
+		if oauthError.Error == "invalid_grant" {
+			return OIDCTokenResponse{}, ErrOIDCInvalidGrant
+		}
+		return OIDCTokenResponse{}, fmt.Errorf("OIDC token endpoint returned HTTP %d", response.StatusCode)
+	}
+	var result OIDCTokenResponse
+	if err := json.NewDecoder(io.LimitReader(response.Body, maxOIDCResponseBytes)).Decode(&result); err != nil || strings.TrimSpace(result.AccessToken) == "" {
+		return OIDCTokenResponse{}, errors.New("OIDC token response is invalid")
+	}
+	return result, nil
+}
+
+func (c *OIDCPublicClient) postForm(ctx context.Context, endpoint string, form url.Values) (*http.Response, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.Header.Set("Accept", "application/json")
+	return c.client.Do(request)
+}
+
+func (c *OIDCPublicClient) discovery(ctx context.Context) (oidcClientDiscovery, error) {
+	c.mu.Lock()
+	if c.metadata.Issuer != "" {
+		metadata := c.metadata
+		c.mu.Unlock()
+		return metadata, nil
+	}
+	c.mu.Unlock()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, c.config.Issuer+"/.well-known/openid-configuration", nil)
+	if err != nil {
+		return oidcClientDiscovery{}, err
+	}
+	request.Header.Set("Accept", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return oidcClientDiscovery{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return oidcClientDiscovery{}, fmt.Errorf("OIDC discovery returned HTTP %d", response.StatusCode)
+	}
+	var metadata oidcClientDiscovery
+	if err := json.NewDecoder(io.LimitReader(response.Body, maxOIDCResponseBytes)).Decode(&metadata); err != nil ||
+		metadata.Issuer != c.config.Issuer || validatePublicURL(metadata.AuthorizationEndpoint) != nil || validatePublicURL(metadata.TokenEndpoint) != nil ||
+		metadata.RevocationEndpoint != "" && validatePublicURL(metadata.RevocationEndpoint) != nil ||
+		metadata.EndSessionEndpoint != "" && validatePublicURL(metadata.EndSessionEndpoint) != nil {
+		return oidcClientDiscovery{}, errors.New("OIDC discovery metadata is invalid")
+	}
+	c.mu.Lock()
+	c.metadata = metadata
+	c.mu.Unlock()
+	return metadata, nil
+}
+
+func normalizedScopes(scopes []string) []string {
+	result := make([]string, 0, len(scopes)+1)
+	seen := map[string]struct{}{}
+	for _, scope := range append([]string{"openid"}, scopes...) {
+		scope = strings.TrimSpace(scope)
+		if scope == "" {
+			continue
+		}
+		if _, ok := seen[scope]; ok {
+			continue
+		}
+		seen[scope] = struct{}{}
+		result = append(result, scope)
+	}
+	return result
+}

apps/api/internal/auth/oidc_client_test.go

@@ -0,0 +1,125 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestOIDCPublicClientUsesAuthorizationCodePKCES256WithoutSecret(t *testing.T) {
+	var issuer string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/.well-known/openid-configuration":
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"issuer": issuer, "authorization_endpoint": issuer + "/authorize",
+				"token_endpoint": issuer + "/token", "revocation_endpoint": issuer + "/revoke",
+				"end_session_endpoint": issuer + "/logout",
+			})
+		case "/token":
+			body, _ := io.ReadAll(r.Body)
+			values, _ := url.ParseQuery(string(body))
+			if values.Get("client_secret") != "" || strings.Contains(r.Header.Get("Authorization"), "Basic") {
+				t.Fatal("public client token request must not contain client credentials")
+			}
+			if values.Get("grant_type") != "authorization_code" || values.Get("client_id") != "gateway-public" || values.Get("code_verifier") != "verifier" {
+				t.Fatalf("unexpected token request: %v", values)
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"access_token": "access-token", "refresh_token": "refresh-token",
+				"id_token": "id-token", "expires_in": 300, "token_type": "Bearer",
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	issuer = server.URL
+
+	client, err := NewOIDCPublicClient(OIDCPublicClientConfig{
+		Issuer: issuer, ClientID: "gateway-public", RedirectURI: "https://gateway.example.com/gateway-api/api/v1/auth/oidc/callback",
+		PostLogoutRedirectURI: "https://gateway.example.com/", Scopes: []string{"openid", "profile", "gateway.access"}, HTTPClient: server.Client(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	authorizationURL, err := client.AuthorizationURL(context.Background(), "state", "nonce", "challenge")
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsed, _ := url.Parse(authorizationURL)
+	query := parsed.Query()
+	if query.Get("response_type") != "code" || query.Get("code_challenge_method") != "S256" || query.Get("code_challenge") != "challenge" {
+		t.Fatalf("authorization request is not PKCE S256: %v", query)
+	}
+	if _, err := client.ExchangeCode(context.Background(), "authorization-code", "verifier"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOIDCPublicClientRejectsOfflineAccess(t *testing.T) {
+	_, err := NewOIDCPublicClient(OIDCPublicClientConfig{
+		Issuer: "https://auth.example.com", ClientID: "gateway-public",
+		RedirectURI:           "https://gateway.example.com/api/v1/auth/oidc/callback",
+		PostLogoutRedirectURI: "https://gateway.example.com/",
+		Scopes:                []string{"openid", "gateway.access", "offline_access"},
+	})
+	if err == nil || !strings.Contains(err.Error(), "offline_access") {
+		t.Fatalf("NewOIDCPublicClient() error = %v, want offline_access rejection", err)
+	}
+}
+
+func TestOIDCPublicClientRefreshAndRevokeNeverSendSecret(t *testing.T) {
+	var issuer string
+	requests := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/.well-known/openid-configuration":
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"issuer": issuer, "authorization_endpoint": issuer + "/authorize",
+				"token_endpoint": issuer + "/token", "revocation_endpoint": issuer + "/revoke",
+				"end_session_endpoint": issuer + "/logout",
+			})
+		case "/token", "/revoke":
+			requests++
+			body, _ := io.ReadAll(r.Body)
+			values, _ := url.ParseQuery(string(body))
+			if values.Get("client_secret") != "" || r.Header.Get("Authorization") != "" {
+				t.Fatal("public client request contained client authentication")
+			}
+			if r.URL.Path == "/token" {
+				if values.Get("grant_type") != "refresh_token" || values.Get("refresh_token") != "old-refresh" {
+					t.Fatalf("unexpected refresh request: %v", values)
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "new-access", "refresh_token": "new-refresh", "expires_in": 300})
+				return
+			}
+			w.WriteHeader(http.StatusOK)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	issuer = server.URL
+	client, err := NewOIDCPublicClient(OIDCPublicClientConfig{
+		Issuer: issuer, ClientID: "gateway-public", RedirectURI: "https://gateway.example.com/callback",
+		PostLogoutRedirectURI: "https://gateway.example.com/", HTTPClient: server.Client(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.Refresh(context.Background(), "old-refresh"); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.RevokeRefreshToken(context.Background(), "new-refresh"); err != nil {
+		t.Fatal(err)
+	}
+	if requests != 2 {
+		t.Fatalf("requests = %d, want 2", requests)
+	}
+}

apps/api/internal/auth/oidc_session_cookie_test.go

@@ -1,50 +1,23 @@
 package auth
 
 import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"encoding/json"
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
-
-	"github.com/golang-jwt/jwt/v5"
 )
 
-func TestAuthenticateAcceptsValidatedOIDCSessionCookie(t *testing.T) {
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var issuer string
-	issuerServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/.well-known/openid-configuration":
-			_ = json.NewEncoder(w).Encode(map[string]any{"issuer": issuer, "jwks_uri": issuer + "/jwks"})
-		case "/jwks":
-			_ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{ecJWK("ec-key", &key.PublicKey)}})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer issuerServer.Close()
-	issuer = issuerServer.URL
-
-	verifier, err := NewOIDCVerifier(OIDCConfig{
-		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
-		RequiredScopes: []string{"gateway.access"}, HTTPClient: issuerServer.Client(),
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
+func TestAuthenticateResolvesOpaqueOIDCSessionCookie(t *testing.T) {
 	authenticator := New("local-jwt-secret", "", "")
-	authenticator.OIDCVerifier = verifier
-	raw := signedOIDCToken(t, issuer, "ec-key", jwt.SigningMethodES256, key, nil)
+	var resolved string
+	authenticator.OIDCSessionResolver = func(_ context.Context, raw string) (*User, error) {
+		resolved = raw
+		return &User{ID: "platform-subject", Source: "oidc", Roles: []string{"user"}}, nil
+	}
 
 	request := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
-	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: raw})
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "opaque-session-id"})
 	user, err := authenticator.Authenticate(request)
 	if err != nil {
 		t.Fatalf("authenticate OIDC session cookie: %v", err)
@@ -52,8 +25,8 @@ func TestAuthenticateAcceptsValidatedOIDCSessionCookie(t *testing.T) {
 	if user.ID != "platform-subject" || user.Source != "oidc" {
 		t.Fatalf("unexpected session user: %#v", user)
 	}
-	if user.TokenExpiresAt.Before(time.Now().Add(50 * time.Minute)) {
-		t.Fatalf("token expiry was not retained: %v", user.TokenExpiresAt)
+	if resolved != "opaque-session-id" {
+		t.Fatalf("session resolver received %q", resolved)
 	}
 }
 
@@ -84,3 +57,19 @@ func TestAuthenticateRejectsInvalidOIDCSessionCookie(t *testing.T) {
 		t.Fatal("invalid OIDC session cookie was accepted")
 	}
 }
+
+func TestPublicRouteIgnoresExpiredOptionalOIDCSession(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {
+		return nil, &RequestAuthError{Status: http.StatusUnauthorized, Code: "OIDC_SESSION_EXPIRED", Message: "expired"}
+	}
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/public/catalog/providers", nil)
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "opaque-session-id"})
+	recorder := httptest.NewRecorder()
+	authenticator.Require(PermissionPublic, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})).ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("public route status = %d, want %d", recorder.Code, http.StatusNoContent)
+	}
+}

apps/api/internal/auth/oidc_test.go

@@ -104,6 +104,35 @@ func TestOIDCVerifierRejectsMissingOrMismatchedSecurityClaims(t *testing.T) {
 	}
 }
 
+func TestOIDCVerifierValidatesIDTokenNonceAndPublicClientAudience(t *testing.T) {
+	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	var issuer string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		if request.URL.Path == "/.well-known/openid-configuration" {
+			_ = json.NewEncoder(w).Encode(map[string]any{"issuer": issuer, "jwks_uri": issuer + "/jwks"})
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{ecJWK("ec-key", &key.PublicKey)}})
+	}))
+	defer server.Close()
+	issuer = server.URL
+	verifier, _ := NewOIDCVerifier(OIDCConfig{
+		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
+		RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
+	})
+	idToken := signedOIDCToken(t, issuer, "ec-key", jwt.SigningMethodES256, key, func(claims jwt.MapClaims) {
+		claims["aud"] = "gateway-public-client"
+		claims["nonce"] = "expected-nonce"
+	})
+	subject, err := verifier.VerifyIDToken(context.Background(), idToken, "gateway-public-client", "expected-nonce")
+	if err != nil || subject != "platform-subject" {
+		t.Fatalf("VerifyIDToken() subject=%q err=%v", subject, err)
+	}
+	if _, err := verifier.VerifyIDToken(context.Background(), idToken, "gateway-public-client", "wrong-nonce"); err == nil {
+		t.Fatal("ID token with mismatched nonce was accepted")
+	}
+}
+
 func TestOIDCVerifierFailsClosedWhenIntrospectionMarksSessionInactive(t *testing.T) {
 	key, _ := rsa.GenerateKey(rand.Reader, 2048)
 	active := true