add

internal/api/api.go

@@ -27,7 +27,7 @@ import (
 
 // Principal is the authenticated identity behind a request.
 type Principal struct {
-	// Mode is "apikey", "basic" or "anonymous".
+	// Mode is "apikey", "basic", "oidc" or "anonymous".
 	Mode string
 	// Name is a human label for the key or user.
 	Name string
@@ -246,6 +246,7 @@ func (s *Server) routes(cfg *config.Config) *http.ServeMux {
 		})))
 	}
 	mux.Handle("POST "+base+"auth/login", s.limited(s.handleLogin))
+	mux.Handle("GET "+base+"auth/config", s.public(s.handleAuthConfig))
 	mux.Handle("POST "+base+"auth/logout", s.authed(s.handleLogout, false))
 
 	// Everything below requires a principal.
@@ -391,6 +392,13 @@ func (s *Server) principal(r *http.Request) (Principal, error) {
 		}
 		switch strings.ToLower(scheme) {
 		case "bearer":
+			// Local sessions minted by /auth/login are 64-character hex
+			// strings. OIDC access tokens are compact JWTs (three segments).
+			// Keep key-based login sessions usable alongside OIDC for scripted
+			// clients, while sending JWT-shaped credentials to the verifier.
+			if s.auth.mode == "oidc" && strings.Count(value, ".") == 2 {
+				return s.auth.oidcPrincipal(value)
+			}
 			return s.auth.session(value)
 		case "basic":
 			user, pass, ok := r.BasicAuth()