rework

internal/api/api.go

@@ -151,8 +151,9 @@ type Server struct {
 }
 
 type session struct {
-	principal Principal
-	expires   time.Time
+	principal   Principal
+	expires     time.Time
+	accessToken string
 }
 
 type limitState struct {
@@ -220,6 +221,8 @@ func (s *Server) routes(cfg *config.Config) *http.ServeMux {
 		})))
 	}
 	mux.Handle("POST "+base+"auth/login", s.limited(s.handleLogin))
+	mux.Handle("GET "+base+"auth/oidc/start", s.limited(s.handleOIDCStart))
+	mux.Handle("POST "+base+"auth/oidc/callback", s.limited(s.handleOIDCCallback))
 	mux.Handle("GET "+base+"auth/config", s.public(s.handleAuthConfig))
 	mux.Handle("POST "+base+"auth/logout", s.authed(s.handleLogout, false))
 
@@ -390,6 +393,12 @@ func (s *Server) principal(r *http.Request) (Principal, error) {
 		}
 		return Principal{}, fmt.Errorf("unsupported auth scheme %q", scheme)
 	}
+	if cookie, err := r.Cookie(browserSessionCookie); err == nil {
+		if !s.cookieRequestAllowed(r) {
+			return Principal{}, errors.New("cross-origin session request")
+		}
+		return s.auth.session(cookie.Value)
+	}
 	if s.cfgTrustLoopback(r) {
 		return Principal{Mode: "loopback", Name: "loopback", Loopback: true}, nil
 	}