rework

internal/config/config.go

@@ -499,10 +499,11 @@ type Auth struct {
 	// Mode is "none", "apikey", "basic" or "oidc".
 	Mode string `yaml:"mode"`
 	// OIDC settings validate access tokens issued by an external provider.
-	OIDCIssuer     string   `yaml:"oidc_issuer"`
-	OIDCAudience   string   `yaml:"oidc_audience"`
-	OIDCClientID   string   `yaml:"oidc_client_id"`
-	OIDCWriteRoles []string `yaml:"oidc_write_roles"`
+	OIDCIssuer      string   `yaml:"oidc_issuer"`
+	OIDCAudience    string   `yaml:"oidc_audience"`
+	OIDCRedirectURI string   `yaml:"oidc_redirect_uri"`
+	OIDCClientID    string   `yaml:"oidc_client_id"`
+	OIDCWriteRoles  []string `yaml:"oidc_write_roles"`
 	// APIKeys grant full access.
 	APIKeys []string `yaml:"api_keys"`
 	// ReadOnlyAPIKeys may only call GET endpoints.
@@ -1231,6 +1232,12 @@ func (c *Config) Validate() error {
 			}
 		}
 	}
+	if raw := c.API.Auth.OIDCRedirectURI; raw != "" {
+		u, err := url.Parse(raw)
+		if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+			add("api.auth.oidc_redirect_uri must be an absolute HTTPS callback URL without query or fragment")
+		}
+	}
 	if c.API.Auth.SessionTTL <= 0 {
 		add("api.auth.session_ttl must be > 0")
 	}