Add OIDC login via Authentik: PKCE, JIT provisioning, email linking (#5)

OIDC is pansy's primary login path (Authentik the target IdP); local
auth (#4) remains the fallback and both issue the same session cookie.

- deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go;
  CGO stays off).
- api/oidc.go: lazy issuer discovery (retried per-request, never crashes
  a server that also serves local auth), GET /auth/oidc/login builds an
  authorization-code URL with PKCE S256 + random state + nonce stashed in
  a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state
  (constant-time), exchanges the code with the PKCE verifier, verifies the
  ID token + nonce, and starts a pansy session. Failures redirect to
  /login?error=... ; success to /gardens.
- service.LoginOIDC: (issuer,subject) match -> login; else *verified*
  email match -> link onto the existing account; else JIT-create (the IdP
  gates access, so PANSY_REGISTRATION doesn't apply). Unverified email
  colliding with an existing account is refused (takeover guard); no email
  is refused (email is the account key). Reuses the atomic CreateUser.
- store: GetUserByOIDC + LinkOIDC (unique-pair backstop).
- config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI);
  /auth/providers now reports oidc from it and defaults the button label
  to "Sign in with Authentik". OIDC routes are only registered when ready,
  so an unconfigured instance 404s them.
- PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC.

Tests: service provisioning (JIT, repeat login, link, unverified-collision
refusal, no-email, name fallback, works with local auth off); api
(routes-absent-when-unconfigured, providers reporting, login redirect with
PKCE params + tx cookie via a fake discovery server, callback state/error
paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable
with the server still up and local auth working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/oidc_test.go

@@ -0,0 +1,114 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+)
+
+// fakeIssuer stands up a minimal OIDC discovery endpoint so oidcClient.ensure
+// succeeds without a real IdP. It only needs to serve the discovery document for
+// the login-initiation and route tests; token exchange is covered by the
+// service-layer provisioning tests and manual Authentik verification.
+func fakeIssuer(t *testing.T) string {
+	t.Helper()
+	mux := http.NewServeMux()
+	var issuer string
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"issuer":                 issuer,
+			"authorization_endpoint": issuer + "/authorize",
+			"token_endpoint":         issuer + "/token",
+			"jwks_uri":               issuer + "/jwks",
+		})
+	})
+	ts := httptest.NewServer(mux)
+	t.Cleanup(ts.Close)
+	issuer = ts.URL
+	return issuer
+}
+
+func oidcCfg(t *testing.T) *config.Config {
+	cfg := localCfg()
+	cfg.BaseURL = "https://pansy.example.com"
+	cfg.OIDC = config.OIDCConfig{Issuer: fakeIssuer(t), ClientID: "pansy-client", ButtonLabel: "Sign in with Authentik"}
+	return cfg
+}
+
+func TestOIDCRoutesAbsentWhenUnconfigured(t *testing.T) {
+	r := authEngine(t, localCfg()) // no OIDC
+	for _, path := range []string{"/api/v1/auth/oidc/login", "/api/v1/auth/oidc/callback"} {
+		w := doJSON(t, r, http.MethodGet, path, nil, nil)
+		if w.Code != http.StatusNotFound {
+			t.Errorf("GET %s status = %d, want 404 when OIDC unconfigured", path, w.Code)
+		}
+	}
+}
+
+func TestProvidersReportsOIDCWhenConfigured(t *testing.T) {
+	r := authEngine(t, oidcCfg(t))
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/providers", nil, nil)
+	var got struct {
+		Local     bool   `json:"local"`
+		OIDC      bool   `json:"oidc"`
+		OIDCLabel string `json:"oidcLabel"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode providers: %v", err)
+	}
+	if !got.OIDC || got.OIDCLabel != "Sign in with Authentik" {
+		t.Errorf("providers = %+v, want oidc=true with Authentik label", got)
+	}
+}
+
+func TestOIDCLoginRedirectsToProviderWithPKCE(t *testing.T) {
+	r := authEngine(t, oidcCfg(t))
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/login", nil, nil)
+	if w.Code != http.StatusFound {
+		t.Fatalf("oidc login status = %d, want 302 (body %s)", w.Code, w.Body.String())
+	}
+	loc := w.Header().Get("Location")
+	for _, want := range []string{"/authorize?", "code_challenge=", "code_challenge_method=S256", "state=", "nonce="} {
+		if !strings.Contains(loc, want) {
+			t.Errorf("auth redirect %q missing %q", loc, want)
+		}
+	}
+	// The transaction cookie must be set so the callback can validate state.
+	var haveTx bool
+	for _, ck := range w.Result().Cookies() {
+		if ck.Name == oidcTxCookie {
+			haveTx = ck.HttpOnly && ck.Value != ""
+		}
+	}
+	if !haveTx {
+		t.Error("expected an HttpOnly pansy_oidc_tx cookie to be set")
+	}
+}
+
+func TestOIDCCallbackWithoutTransactionRejected(t *testing.T) {
+	r := authEngine(t, oidcCfg(t))
+	// No tx cookie → state can't be validated → redirect to login with error=state.
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/callback?state=abc&code=xyz", nil, nil)
+	if w.Code != http.StatusFound {
+		t.Fatalf("callback status = %d, want 302", w.Code)
+	}
+	if loc := w.Header().Get("Location"); !strings.Contains(loc, "error=state") {
+		t.Errorf("callback redirect = %q, want error=state", loc)
+	}
+}
+
+func TestOIDCCallbackProviderErrorRedirects(t *testing.T) {
+	r := authEngine(t, oidcCfg(t))
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/callback?error=access_denied", nil, nil)
+	if w.Code != http.StatusFound {
+		t.Fatalf("callback status = %d, want 302", w.Code)
+	}
+	if loc := w.Header().Get("Location"); !strings.Contains(loc, "error=oidc") {
+		t.Errorf("callback redirect = %q, want error=oidc", loc)
+	}
+}