Add OIDC login via Authentik: PKCE, JIT provisioning, email linking (#5)

OIDC is pansy's primary login path (Authentik the target IdP); local
auth (#4) remains the fallback and both issue the same session cookie.

- deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go;
  CGO stays off).
- api/oidc.go: lazy issuer discovery (retried per-request, never crashes
  a server that also serves local auth), GET /auth/oidc/login builds an
  authorization-code URL with PKCE S256 + random state + nonce stashed in
  a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state
  (constant-time), exchanges the code with the PKCE verifier, verifies the
  ID token + nonce, and starts a pansy session. Failures redirect to
  /login?error=... ; success to /gardens.
- service.LoginOIDC: (issuer,subject) match -> login; else *verified*
  email match -> link onto the existing account; else JIT-create (the IdP
  gates access, so PANSY_REGISTRATION doesn't apply). Unverified email
  colliding with an existing account is refused (takeover guard); no email
  is refused (email is the account key). Reuses the atomic CreateUser.
- store: GetUserByOIDC + LinkOIDC (unique-pair backstop).
- config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI);
  /auth/providers now reports oidc from it and defaults the button label
  to "Sign in with Authentik". OIDC routes are only registered when ready,
  so an unconfigured instance 404s them.
- PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC.

Tests: service provisioning (JIT, repeat login, link, unverified-collision
refusal, no-email, name fallback, works with local auth off); api
(routes-absent-when-unconfigured, providers reporting, login redirect with
PKCE params + tx cookie via a fake discovery server, callback state/error
paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable
with the server still up and local auth working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/auth_test.go

@@ -280,15 +280,112 @@ func TestCleanupExpiredSessions(t *testing.T) {
 }
 
 func TestProvidersReflectsConfig(t *testing.T) {
-	cfg := openConfig()
-	cfg.OIDC.ButtonLabel = "Sign in with Authentik"
-	s := newTestService(t, cfg)
-
+	// No OIDC configured → local only.
+	s := newTestService(t, openConfig())
 	p := s.Providers()
-	if !p.Local {
-		t.Error("expected local=true")
+	if !p.Local || p.OIDC {
+		t.Errorf("providers = %+v, want local=true oidc=false", p)
 	}
-	if p.OIDC {
-		t.Error("OIDC must be false until #5 wires it")
+
+	// OIDC configured with a base URL → reported ready.
+	ready := openConfig()
+	ready.BaseURL = "https://pansy.example.com"
+	ready.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid", ButtonLabel: "Sign in with Authentik"}
+	if got := newTestService(t, ready).Providers(); !got.OIDC || got.OIDCLabel != "Sign in with Authentik" {
+		t.Errorf("providers = %+v, want oidc=true with Authentik label", got)
+	}
+
+	// OIDC configured but no base URL → not ready (can't build a redirect URI).
+	noBase := openConfig()
+	noBase.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid"}
+	if got := newTestService(t, noBase).Providers(); got.OIDC {
+		t.Error("OIDC should be false without a base URL")
+	}
+}
+
+func oidcIdentity(sub, email, name string, verified bool) OIDCIdentity {
+	return OIDCIdentity{Issuer: "https://idp.example", Subject: sub, Email: email, EmailVerified: verified, Name: name}
+}
+
+func TestLoginOIDCJITProvisionsThenReturnsSameUser(t *testing.T) {
+	s := newTestService(t, openConfig())
+
+	u, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-1", "[email protected]", "Alice", true))
+	if err != nil {
+		t.Fatalf("LoginOIDC create: %v", err)
+	}
+	if !u.IsAdmin {
+		t.Error("first provisioned OIDC user should be admin")
+	}
+	if u.OIDCSubject == nil || *u.OIDCSubject != "sub-1" {
+		t.Errorf("oidc subject not stamped: %+v", u.OIDCSubject)
+	}
+
+	// A second login with the same identity returns the same user (no duplicate).
+	again, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-1", "[email protected]", "Alice", true))
+	if err != nil {
+		t.Fatalf("LoginOIDC repeat: %v", err)
+	}
+	if again.ID != u.ID {
+		t.Errorf("repeat login made a new user: %d vs %d", again.ID, u.ID)
+	}
+}
+
+func TestLoginOIDCLinksExistingLocalAccount(t *testing.T) {
+	s := newTestService(t, openConfig())
+	local := mustRegister(t, s, "[email protected]", "Bob", "password123")
+
+	linked, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-2", "[email protected]", "Bob", true))
+	if err != nil {
+		t.Fatalf("LoginOIDC link: %v", err)
+	}
+	if linked.ID != local.ID {
+		t.Errorf("linked to a new user %d, want existing %d", linked.ID, local.ID)
+	}
+	if linked.OIDCSubject == nil || *linked.OIDCSubject != "sub-2" {
+		t.Error("existing account was not stamped with the oidc identity")
+	}
+	// Local password still works after linking (one account, two methods).
+	if _, err := s.Login(context.Background(), "[email protected]", "password123"); err != nil {
+		t.Errorf("local login after linking failed: %v", err)
+	}
+}
+
+func TestLoginOIDCRefusesUnverifiedEmailCollision(t *testing.T) {
+	s := newTestService(t, openConfig())
+	mustRegister(t, s, "[email protected]", "Carol", "password123")
+
+	_, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-3", "[email protected]", "Carol", false))
+	if !errors.Is(err, domain.ErrOIDCEmailUnverified) {
+		t.Errorf("unverified collision err = %v, want ErrOIDCEmailUnverified", err)
+	}
+}
+
+func TestLoginOIDCRequiresEmail(t *testing.T) {
+	s := newTestService(t, openConfig())
+	_, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-4", "", "No Email", true))
+	if !errors.Is(err, domain.ErrOIDCNoEmail) {
+		t.Errorf("no-email err = %v, want ErrOIDCNoEmail", err)
+	}
+}
+
+func TestLoginOIDCFallsBackToEmailLocalPartForName(t *testing.T) {
+	s := newTestService(t, openConfig())
+	u, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-5", "[email protected]", "", true))
+	if err != nil {
+		t.Fatalf("LoginOIDC: %v", err)
+	}
+	if u.DisplayName != "dave" {
+		t.Errorf("display name = %q, want %q", u.DisplayName, "dave")
+	}
+}
+
+func TestLocalAuthDisabledDoesNotBlockOIDC(t *testing.T) {
+	cfg := openConfig()
+	cfg.LocalAuth = false
+	s := newTestService(t, cfg)
+	// OIDC provisioning must work even when local auth is off (pure-Authentik).
+	if _, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-6", "[email protected]", "Erin", true)); err != nil {
+		t.Errorf("LoginOIDC with local auth disabled: %v", err)
 	}
 }