rework

internal/api/auth.go

@@ -41,28 +41,31 @@ type authenticator struct {
 	// sessionTTL is how long an issued token stays valid.
 	sessionTTL time.Duration
 	// trustLoopback is informational; the caller checks it.
-	mu             sync.RWMutex
-	sessions       map[string]session
-	oidcIssuer     string
-	oidcAudience   string
-	oidcClientID   string
-	oidcWriteRoles map[string]bool
-	oidcInitMu     sync.Mutex
-	oidcVerifier   *oidc.IDTokenVerifier
+	mu              sync.RWMutex
+	sessions        map[string]session
+	oidcPending     map[string]oidcLogin
+	oidcRedirectURI string
+	oidcIssuer      string
+	oidcAudience    string
+	oidcClientID    string
+	oidcWriteRoles  map[string]bool
+	oidcInitMu      sync.Mutex
+	oidcVerifier    *oidc.IDTokenVerifier
 }
 
 func newAuthenticator(cfg config.Auth) *authenticator {
 	a := &authenticator{
-		mode:           cfg.Mode,
-		readOnly:       make(map[string]string, len(cfg.ReadOnlyAPIKeys)),
-		readWrite:      make(map[string]string, len(cfg.APIKeys)),
-		username:       cfg.Username,
-		sessionTTL:     cfg.SessionTTL.D(),
-		sessions:       make(map[string]session),
-		oidcIssuer:     cfg.OIDCIssuer,
-		oidcAudience:   cfg.OIDCAudience,
-		oidcClientID:   cfg.OIDCClientID,
-		oidcWriteRoles: make(map[string]bool),
+		mode:            cfg.Mode,
+		readOnly:        make(map[string]string, len(cfg.ReadOnlyAPIKeys)),
+		readWrite:       make(map[string]string, len(cfg.APIKeys)),
+		username:        cfg.Username,
+		sessionTTL:      cfg.SessionTTL.D(),
+		sessions:        make(map[string]session),
+		oidcRedirectURI: cfg.OIDCRedirectURI,
+		oidcIssuer:      cfg.OIDCIssuer,
+		oidcAudience:    cfg.OIDCAudience,
+		oidcClientID:    cfg.OIDCClientID,
+		oidcWriteRoles:  make(map[string]bool),
 	}
 	for _, role := range cfg.OIDCWriteRoles {
 		a.oidcWriteRoles[role] = true
@@ -237,6 +240,9 @@ func (a *authenticator) session(token string) (Principal, error) {
 		a.mu.Unlock()
 		return Principal{}, errors.New("session expired")
 	}
+	if s.accessToken != "" {
+		return a.oidcPrincipal(s.accessToken)
+	}
 	return s.principal, nil
 }
 
@@ -330,6 +336,10 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 
 // handleLogout drops the caller's session.
 func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	if c, err := r.Cookie(browserSessionCookie); err == nil {
+		s.auth.revoke(c.Value)
+	}
+	s.setBrowserCookie(w, browserSessionCookie, "", -1)
 	if h := r.Header.Get("Authorization"); h != "" {
 		if scheme, value, ok := cut(h, " "); ok && scheme == "Bearer" {
 			s.auth.revoke(value)