shankar0123 e7c4654b16 harden(auth/session+oidc): 503/401 split + go-oidc string pin (LOW-6 + Nit-2) ...

Audit 2026-05-10 — close LOW-6 + Nit-2 from the HANDOFF.md backend
batch (items 8 + 9).

LOW-6: introduce ErrSessionTransient sentinel in session.Service.
session.Validate now distinguishes:
  - errors.Is(err, repository.ErrSessionNotFound) → ErrSessionInvalidCookie (401)
  - All other repo errors                         → ErrSessionTransient (503)
The session middleware maps ErrSessionTransient to HTTP 503 with
Retry-After: 1. Pre-fix, every DB hiccup looked like a forged-cookie
401 and forced the user to re-authenticate on a transient outage.
Two new regression tests pin the wire shape:
  - TestService_Validate_TransientSessionGetError (service layer)
  - TestService_Validate_SessionNotFoundMapsToInvalidCookie (negative
    leg: not-found stays 401)
  - TestSessionMiddleware_TransientErrorMappedTo503 (middleware-level
    503 + Retry-After header)

Nit-2: isJWKSFetchError documentation now pins go-oidc/v3 v3.18.0 as
the source-of-truth string set. v3.18.0 exposes only
*oidc.TokenExpiredError as a typed error; JWKS-fetch failures bubble
up as fmt.Errorf-wrapped strings. New regression test
TestIsJWKSFetchError_GoOIDCV318Strings pins the canonical substrings
emitted by go-oidc's jwks.go — a future upstream bump that changes
the wording trips the test and forces the matcher to be re-derived.
The test caught a real gap: 'oidc: failed to decode keys' (emitted
when the IdP returns non-JSON at the jwks_uri — broken proxy, gateway
HTML error page, etc.) was previously misclassified as a generic 500
instead of 503 ErrJWKSUnreachable. Added 'decode keys' substring to
the matcher.

Status: LOW-6 + Nit-2 marked CLOSED in audit-doc table.

Refs: cowork/auth-bundles-fixes-2026-05-10/HANDOFF.md items 8, 9
      cowork/auth-bundles-audit-2026-05-10.md LOW-6, Nit-2

2026-05-10 22:41:19 +00:00

..

bootstrap

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

breakglass

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

oidc

harden(auth/session+oidc): 503/401 split + go-oidc string pin (LOW-6 + Nit-2)

2026-05-10 22:41:19 +00:00

session

harden(auth/session+oidc): 503/401 split + go-oidc string pin (LOW-6 + Nit-2)

2026-05-10 22:41:19 +00:00

user/domain

auth-bundle-2 Phase 1: OIDC + Session + User + Breakglass domain types

2026-05-10 03:41:46 +00:00

apikey.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

context.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

keystore_test.go

auth-bundle-1 follow-on: close coverage gaps to clear Phase 12 floors

2026-05-10 02:04:36 +00:00

keystore.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

middleware_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

middleware.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

protocol_endpoints.go

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

require_permission_test.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

require_permission.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

rotation_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

testfixtures.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00