feat: enforce OIDC session introspection

2026-07-12 05:44:37 +08:00
parent b9c0e1a7a5
commit f8d766b916
5 changed files with 145 additions and 32 deletions
@@ -44,7 +44,10 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 		verifier, err := auth.NewOIDCVerifier(auth.OIDCConfig{
 			Issuer: cfg.OIDCIssuer, Audience: cfg.OIDCAudience, TenantID: cfg.OIDCTenantID,
 			RolePrefix: cfg.OIDCRolePrefix, RequiredScopes: cfg.OIDCRequiredScopes,
-			JWKSCacheTTL: time.Duration(cfg.OIDCJWKSCacheTTLSeconds) * time.Second,
+			JWKSCacheTTL:              time.Duration(cfg.OIDCJWKSCacheTTLSeconds) * time.Second,
+			IntrospectionEnabled:      cfg.OIDCIntrospectionEnabled,
+			IntrospectionClientID:     cfg.OIDCIntrospectionClientID,
+			IntrospectionClientSecret: cfg.OIDCIntrospectionClientSecret,
 		})
 		if err != nil {
 			panic("invalid OIDC configuration: " + err.Error())