Address Gadfly review on #5: OIDC identity guard, verified-email, timeouts

Fixes from the PR #24 adversarial review (graded 23 real / 1 false positive):

Security / correctness
- LinkOIDC no longer overwrites a different stored identity: the UPDATE
  matches only when the row has no identity yet or already carries this
  exact one, so a second IdP asserting the same verified email can't
  hijack or lock out an account (returns ErrOIDCIdentityConflict). Uses
  a single UPDATE...RETURNING (also fixes the ignored-RowsAffected /
  misleading-ErrNotFound path and the round-trip).
- Provisioning now requires a verified email for BOTH linking and JIT
  creation (was: linking only), so an unverified-email identity can't
  create an account — nor become the first admin on a fresh instance,
  nor squat an email a real user later owns.
- OIDC-identity collisions surface as the dedicated ErrOIDCIdentityConflict
  instead of the email-specific ErrEmailTaken.

Robustness
- readOIDCTxCookie requires a non-empty nonce (an empty one would make the
  callback's nonce check pass vacuously).
- Callback token exchange + verify run under a 15s context timeout so a
  slow IdP can't outlast the server write timeout.
- ensure() performs discovery outside the mutex, so concurrent cold-start
  requests don't serialize behind one another's full timeout.
- setOIDCTxCookie returns its marshal error; oidcLogin aborts rather than
  redirecting to the IdP with no tx cookie.

Maintainability
- redirectAuthError helper dedups the ~dozen callback redirects (and the
  empty-code path now logs like the rest).
- Distinct login error codes (no_email / email_unverified / oidc_conflict)
  for the UI; writeServiceError maps the OIDC sentinels; shared test issuer
  const.

Tests: unverified email refused for both link and JIT; identity-overwrite
refused while the original identity keeps working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/auth.go

@@ -57,19 +57,23 @@ func (s *Service) Providers() Providers {
 // issuing no session itself (the caller does). The IdP has already gated access,
 // so PANSY_REGISTRATION does not apply. Resolution order:
 //  1. an existing user with the same (issuer, subject) — a returning OIDC user;
-//  2. else an existing user with the same *verified* email — linked to this
-//     identity (so one person isn't split across a local and an OIDC account);
+//  2. else an existing user with the same email — linked to this identity (so
+//     one person isn't split across a local and an OIDC account);
 //  3. else a new just-in-time account stamped with the identity.
 //
-// An unverified email that collides with an existing account is refused (it
-// would let anyone who can assert that email at the IdP take over the account).
-// An identity with no email can't be provisioned (email is the account key).
+// Steps 2 and 3 require a verified email: linking on an unverified email would
+// let anyone who can assert that email at an IdP take over an account, and
+// JIT-creating on one would let them squat an email a real user later owns
+// (then the real user's different identity would be refused by LinkOIDC). An
+// identity with no email can't be provisioned at all (email is the account key).
+// Returning users (step 1) skip the email check — their identity is already
+// proven.
 func (s *Service) LoginOIDC(ctx context.Context, id OIDCIdentity) (*domain.User, error) {
 	if id.Issuer == "" || id.Subject == "" {
 		return nil, domain.ErrInvalidInput
 	}
 
-	// 1. Returning OIDC user.
+	// 1. Returning OIDC user (identity already proven; email state irrelevant).
 	u, err := s.store.GetUserByOIDC(ctx, id.Issuer, id.Subject)
 	if err == nil {
 		return u, nil
@@ -78,18 +82,20 @@ func (s *Service) LoginOIDC(ctx context.Context, id OIDCIdentity) (*domain.User,
 		return nil, err
 	}
 
+	// Provisioning (link or create) requires a verified email.
 	email := normalizeEmail(id.Email)
 	if email == "" {
 		return nil, domain.ErrOIDCNoEmail
 	}
+	if !id.EmailVerified {
+		return nil, domain.ErrOIDCEmailUnverified
+	}
 
-	// 2. Link to an existing account by email — but only a verified one.
+	// 2. Link to an existing account by email. LinkOIDC refuses to overwrite a
+	// different stored identity (returns ErrOIDCIdentityConflict).
 	existing, err := s.store.GetUserByEmail(ctx, email)
 	switch {
 	case err == nil:
-		if !id.EmailVerified {
-			return nil, domain.ErrOIDCEmailUnverified
-		}
 		return s.store.LinkOIDC(ctx, existing.ID, id.Issuer, id.Subject)
 	case !errors.Is(err, domain.ErrNotFound):
 		return nil, err

internal/service/auth_test.go

@@ -290,7 +290,7 @@ func TestProvidersReflectsConfig(t *testing.T) {
 	// OIDC configured with a base URL → reported ready.
 	ready := openConfig()
 	ready.BaseURL = "https://pansy.example.com"
-	ready.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid", ButtonLabel: "Sign in with Authentik"}
+	ready.OIDC = config.OIDCConfig{Issuer: testOIDCIssuer, ClientID: "cid", ButtonLabel: "Sign in with Authentik"}
 	if got := newTestService(t, ready).Providers(); !got.OIDC || got.OIDCLabel != "Sign in with Authentik" {
 		t.Errorf("providers = %+v, want oidc=true with Authentik label", got)
 	}
@@ -303,8 +303,11 @@ func TestProvidersReflectsConfig(t *testing.T) {
 	}
 }
 
+// testOIDCIssuer is the issuer URL used across the OIDC service tests.
+const testOIDCIssuer = "https://idp.example"
+
 func oidcIdentity(sub, email, name string, verified bool) OIDCIdentity {
-	return OIDCIdentity{Issuer: "https://idp.example", Subject: sub, Email: email, EmailVerified: verified, Name: name}
+	return OIDCIdentity{Issuer: testOIDCIssuer, Subject: sub, Email: email, EmailVerified: verified, Name: name}
 }
 
 func TestLoginOIDCJITProvisionsThenReturnsSameUser(t *testing.T) {
@@ -351,14 +354,47 @@ func TestLoginOIDCLinksExistingLocalAccount(t *testing.T) {
 	}
 }
 
-func TestLoginOIDCRefusesUnverifiedEmailCollision(t *testing.T) {
+func TestLoginOIDCRefusesUnverifiedEmail(t *testing.T) {
 	s := newTestService(t, openConfig())
-	mustRegister(t, s, "[email protected]", "Carol", "password123")
 
-	_, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-3", "[email protected]", "Carol", false))
-	if !errors.Is(err, domain.ErrOIDCEmailUnverified) {
+	// Unverified email colliding with an existing account is refused (takeover).
+	mustRegister(t, s, "[email protected]", "Carol", "password123")
+	if _, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-3", "[email protected]", "Carol", false)); !errors.Is(err, domain.ErrOIDCEmailUnverified) {
 		t.Errorf("unverified collision err = %v, want ErrOIDCEmailUnverified", err)
 	}
+
+	// Unverified email with NO collision is also refused (can't JIT-provision on
+	// an unverified email — it could squat an address a real user later owns, and
+	// could make an unverified identity the first admin).
+	if _, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-3b", "[email protected]", "Fresh", false)); !errors.Is(err, domain.ErrOIDCEmailUnverified) {
+		t.Errorf("unverified JIT err = %v, want ErrOIDCEmailUnverified", err)
+	}
+}
+
+func TestLoginOIDCRefusesOverwritingDifferentIdentity(t *testing.T) {
+	s := newTestService(t, openConfig())
+
+	// A user links identity A.
+	first, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-A", "[email protected]", "Dana", true))
+	if err != nil {
+		t.Fatalf("initial link: %v", err)
+	}
+
+	// A different identity asserting the same verified email must NOT overwrite
+	// the stored identity (that would hijack/lock out the account).
+	_, err = s.LoginOIDC(context.Background(), oidcIdentity("sub-B", "[email protected]", "Dana", true))
+	if !errors.Is(err, domain.ErrOIDCIdentityConflict) {
+		t.Fatalf("overwrite attempt err = %v, want ErrOIDCIdentityConflict", err)
+	}
+
+	// The original identity still works and still points at the same account.
+	again, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-A", "[email protected]", "Dana", true))
+	if err != nil || again.ID != first.ID {
+		t.Errorf("original identity broken: user=%v err=%v", again, err)
+	}
+	if again.OIDCSubject == nil || *again.OIDCSubject != "sub-A" {
+		t.Errorf("stored identity was overwritten: %v", again.OIDCSubject)
+	}
 }
 
 func TestLoginOIDCRequiresEmail(t *testing.T) {