gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-10 12:48:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth/ux): cause-aware OIDC + session error surfacing (HIGH-7 + HIGH-8 closure)

Browse Source 
Server (HIGH-7): the OIDC callback failure path now 302-redirects to
/login?error=oidc_failed&reason=<category> instead of emitting a blank
400. `category` is the existing audit `failure_category` value;
classifyOIDCFailure was extended with three new sentinel paths
(email_domain_not_allowed, email_missing_but_required, pkce_invalid)
so CRIT-5 + PKCE failures get distinguishable GUI rendering.
Audit-log observability is unchanged — the same failure_category is
written to the auth.oidc_login_failed audit row; the 302 is purely a
UX leg layered on top.

Server (HIGH-8): SessionMiddleware now stashes a cause classification
on the request context when Validate returns an error, mapping the
sentinels via classifySessionError (errors.Is-based, so wrapped
sentinels still classify) to the stable wire-strings idle_timeout /
absolute_timeout / back_channel_revoked / invalid_token. The 401
emit point in bearerSkipIfAuthenticated reads the stashed cause and
emits WWW-Authenticate: Bearer realm="certctl", error="invalid_token",
error_description=<cause> per RFC 6750 §3.

GUI (HIGH-7): LoginPage reads ?error= + ?reason= from the URL via
react-router useSearchParams and renders an operator-friendly
amber-bordered banner above the form; OIDC_FAILURE_REASON_TEXT maps
all 16 known categories with a defensive 'unspecified' fallback for
forward-compat with future server-side categories.

GUI (HIGH-8): api/client fetchJSON parses the WWW-Authenticate cause
via parseWWWAuthenticateCause and attaches it to the
'certctl:auth-required' CustomEvent detail; AuthProvider redirects
to /login?session_expired=<cause> on cause-aware 401s; LoginPage
renders a blue-bordered session-cause banner. invalid_token stays
on the current page (no hard redirect for opaque failures).

Misc cleanup: ErrorState now accepts the title/message/data-testid
form added by CRIT-4 BreakglassPage (was erroring tsc on master).

Regression matrix:
- internal/api/handler/oidc_redirect_categories_test.go pins all 16
  failure categories to the 302 + reason= location + audit-row leg
- internal/auth/session/www_authenticate_test.go pins the 4 stable
  cause categories on classifySessionError (incl. errors.Is wrapped
  sentinels) + the WWW-Authenticate emission across all 4 categories
  + the no-session-context fallback case
- internal/api/handler/auth_session_oidc_test.go: 4 pre-existing
  TestLoginCallback_*Returns400 tests updated to assert 302 + reason=
  location (the wire shape changed from 400 to 302, but the audit
  observability and behaviour-equivalent failure-classification are
  preserved)
- web/src/pages/LoginPage.test.tsx: 6 new cases pinning the failure
  banner, session-cause banner, unknown-reason fallback, and
  forward-compat 'unspecified' category

Spec: cowork/auth-bundles-fixes-2026-05-10/08-high-7-8-error-surfacing.md
Closes: HIGH-7, HIGH-8 of cowork/auth-bundles-audit-2026-05-10.md
This commit is contained in:
shankar0123
2026-05-10 21:12:11 +00:00
parent 32c97777b5
commit 2015ff46cd
10 changed files with 633 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/handler/auth_session_oidc_test.go
+27 -15
View File
@@ -362,9 +362,11 @@ func TestLoginCallback_HappyPath(t *testing.T) {
}
}
// Phase 5 spec mandate #4: Callback with replayed state -> 400.
// Phase 5 spec mandate #4: Callback with replayed state -> 302 to /login.
// (The OIDC service's PreLoginStore.LookupAndConsume returns
// ErrPreLoginNotFound on the second call; the handler maps to 400.)
// ErrPreLoginNotFound on the second call; Audit 2026-05-10 HIGH-7
// flipped this from a blank 400 to a 302 to /login?error=oidc_failed
// &reason=<category>. The audit row still records failure_category.)
func TestLoginCallback_ReplayedState_Returns400(t *testing.T) {
o := &stubOIDCSvc{callbackErr: oidcsvc.ErrPreLoginNotFound}
h, _, _, _, audit, _ := newPhase5Handler(t, o, &stubSession{}, &stubBCLVerifier{})
@@ -373,17 +375,20 @@ func TestLoginCallback_ReplayedState_Returns400(t *testing.T) {
req.AddCookie(&http.Cookie{Name: sessiondomain.PreLoginCookieName, Value: "v1.pl-abc.sk-xyz.mac"})
w := httptest.NewRecorder()
h.LoginCallback(w, req)
if w.Code != http.StatusBadRequest {
t.Errorf("status = %d; want 400", w.Code)
if w.Code != http.StatusFound {
t.Errorf("status = %d; want 302 (post-HIGH-7 redirect)", w.Code)
}
if loc := w.Header().Get("Location"); !strings.HasPrefix(loc, "/login?error=oidc_failed&reason=") {
t.Errorf("Location = %q; want /login?error=oidc_failed&reason=...", loc)
}
if !contains(audit.events, "auth.oidc_login_failed") {
t.Errorf("expected auth.oidc_login_failed audit event; got %v", audit.events)
}
}
// Phase 5 spec mandate #5: Callback with PKCE verifier mismatch -> 400.
// Phase 5 spec mandate #5: Callback with PKCE verifier mismatch -> 302.
// The OIDC service's code-exchange step fails when the verifier doesn't
// match the challenge; the handler surfaces it as 400.
// match the challenge; HIGH-7 redirects to /login with reason.
func TestLoginCallback_PKCEVerifierMismatch_Returns400(t *testing.T) {
o := &stubOIDCSvc{callbackErr: errors.New("oidc: code exchange failed: invalid_grant")}
h, _, _, _, _, _ := newPhase5Handler(t, o, &stubSession{}, &stubBCLVerifier{})
@@ -391,23 +396,27 @@ func TestLoginCallback_PKCEVerifierMismatch_Returns400(t *testing.T) {
req.AddCookie(&http.Cookie{Name: sessiondomain.PreLoginCookieName, Value: "v1.pl-abc.sk-xyz.mac"})
w := httptest.NewRecorder()
h.LoginCallback(w, req)
if w.Code != http.StatusBadRequest {
t.Errorf("status = %d; want 400", w.Code)
if w.Code != http.StatusFound {
t.Errorf("status = %d; want 302 (post-HIGH-7 redirect)", w.Code)
}
if loc := w.Header().Get("Location"); !strings.HasPrefix(loc, "/login?error=oidc_failed") {
t.Errorf("Location = %q; want /login?error=oidc_failed&reason=...", loc)
}
}
// Phase 5 spec mandate #6: Callback with expired pre-login row -> 400.
// Phase 5 spec mandate #6: Callback with expired pre-login row -> 302.
func TestLoginCallback_ExpiredPreLoginRow_Returns400(t *testing.T) {
// Adapter maps ErrPreLoginExpired -> ErrPreLoginNotFound (uniform
// 400 per spec; specific reason in audit row).
// Adapter maps ErrPreLoginExpired -> ErrPreLoginNotFound; HIGH-7
// flipped the wire shape from 400 to a 302 redirect (specific
// reason still in audit row).
o := &stubOIDCSvc{callbackErr: oidcsvc.ErrPreLoginNotFound}
h, _, _, _, _, _ := newPhase5Handler(t, o, &stubSession{}, &stubBCLVerifier{})
req := httptest.NewRequest(http.MethodGet, "/auth/oidc/callback?code=abc&state=xyz", nil)
req.AddCookie(&http.Cookie{Name: sessiondomain.PreLoginCookieName, Value: "v1.pl-abc.sk-xyz.mac"})
w := httptest.NewRecorder()
h.LoginCallback(w, req)
if w.Code != http.StatusBadRequest {
t.Errorf("status = %d; want 400", w.Code)
if w.Code != http.StatusFound {
t.Errorf("status = %d; want 302 (post-HIGH-7 redirect)", w.Code)
}
}
@@ -431,8 +440,11 @@ func TestLoginCallback_UnmappedGroups_AuditRowDistinguished(t *testing.T) {
req.AddCookie(&http.Cookie{Name: sessiondomain.PreLoginCookieName, Value: "v1.pl-abc.sk-xyz.mac"})
w := httptest.NewRecorder()
h.LoginCallback(w, req)
if w.Code != http.StatusBadRequest {
t.Errorf("status = %d; want 400", w.Code)
if w.Code != http.StatusFound {
t.Errorf("status = %d; want 302 (post-HIGH-7 redirect)", w.Code)
}
if loc := w.Header().Get("Location"); !strings.Contains(loc, "reason=unmapped_groups") {
t.Errorf("Location = %q; want reason=unmapped_groups", loc)
}
if !contains(audit.events, "auth.oidc_login_unmapped_groups") {
t.Errorf("expected auth.oidc_login_unmapped_groups; got %v", audit.events)