From a49fa8514ac2f4666f2b0fd8dd237bbebadf3fc4 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 4 Feb 2026 12:03:56 +0000 Subject: [PATCH] Cover OIDC callback public access --- internal/api/security_regression_test.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go index 38695f290..b7e11b243 100644 --- a/internal/api/security_regression_test.go +++ b/internal/api/security_regression_test.go @@ -2753,6 +2753,22 @@ func TestOIDCLoginBypassesAuth(t *testing.T) { } } +func TestOIDCCallbackBypassesAuth(t *testing.T) { + cfg := newTestConfigWithTokens(t) + cfg.AuthUser = "admin" + cfg.AuthPass = "hashed" + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + ResetRateLimitForIP("203.0.113.51") + req := httptest.NewRequest(http.MethodGet, config.DefaultOIDCCallbackPath, nil) + req.RemoteAddr = "203.0.113.51:1234" + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusNotFound { + t.Fatalf("expected 404 when OIDC is disabled, got %d", rec.Code) + } +} + func TestAIOAuthCallbackBypassesAuth(t *testing.T) { cfg := newTestConfigWithTokens(t) cfg.AuthUser = "admin"