feat: support OAuth2 profile sign-in and account linking by linkdata · Pull Request #21 · linkdata/jawsauth

linkdata · 2026-11-04T11:47:38Z

Summary

Add OIDC and OAuth2 profile sign-in with state, PKCE, bounded provider requests and session rotation.
Isolate providers with namespaces and issuer checks, and support opt-in account linking within one JaWS session.
Share a rotation lock by default; applications can set separate locks for independent JaWS instances.

Verification

Root and cmd race tests, vet, staticcheck, golangci-lint and gosec passed locally.
Keycloak OIDC and GitLab OAuth2 profile sign-in and linking passed against live containers.
CI pins staticcheck, golangci-lint and gosec at revisions compatible with stable Go.

Use provider-scoped JaWS session keys, lossless profile IDs, and a pre-rotation link callback. Extend only pending OAuth sessions through the provider visit and bound profile auth lifetime.

Bind UserInfo requests to callback context so slow profile requests stop at the provider deadline. Reject explicit zero token expiry while retaining the cap for omitted expiry, and return an error for unconfigured link starts.

Clarify shared JaWS locking, validate discovered metadata by its provider keys, and stabilize auth lifecycle tests. Pin gosec to an immutable revision.

Return gateway errors for token exchange failures, clarify multi-provider setup and logout events, and simplify OAuth return handling.

linkdata added 14 commits November 4, 2026 09:07

feat(auth): isolate provider session keys

c39e4c3

feat(auth): support OAuth profile linking and bounded flows

db7080c

Use provider-scoped JaWS session keys, lossless profile IDs, and a pre-rotation link callback. Extend only pending OAuth sessions through the provider visit and bound profile auth lifetime.

fix(auth): bound provider callbacks and session retention

1f26ab6

test(auth): isolate overlapping provider flows

ea903d1

fix: cancel stale OAuth callbacks on logout

4726e13

fix: reject invalid OAuth identities at callback completion

ee25930

fix: handle short profile tokens and offline consent

c3ee58e

fix(oauth): honor UserInfo deadlines and token expiry

17cad04

Bind UserInfo requests to callback context so slow profile requests stop at the provider deadline. Reject explicit zero token expiry while retaining the cap for omitted expiry, and return an error for unconfigured link starts.

fix: preserve OAuth flows across auth expiry

2db75e6

fix: reject OAuth token endpoint redirects

1dfddcf

ci: update Staticcheck for Go 1.27

51fc0b4

ci: update golangci-lint for Go 1.27

dee95e7

ci: update gosec for Go 1.27

da37551

feat: serialize OAuth session rotation with link writes

6d11b14

linkdata mentioned this pull request Nov 4, 2026

feat: add user OAuth sign-in and account linking linkdata/minion#349

Merged

linkdata added 15 commits November 4, 2026 13:35

fix: preserve OAuth flows across concurrent auth changes

dd15208

fix: bound pending login grace and stale auth timers

a105ae7

docs: describe bounded auth timer cleanup

cc839ed

fix: bound OAuth refresh and login redirects

784685d

test: bound OAuth callback synchronization waits

5e48aea

fix: enforce HTTPS for discovered OIDC endpoints

be6d723

fix: serialize auth revocation and bound OIDC verification

86fc195

test: assert locked revocation callback

9111a3e

fix: serialize built-in logout with account links

aaa6714

fix(auth): preserve pending login and simplify provider flows

d8024f6

fix: serialize link callbacks with auth revocation

7e1831b

fix: simplify OAuth flows and guard refresh identity

679a075

fix: simplify OAuth callbacks and clarify provider docs

7885841

fix: guard linked identity expiry and simplify OAuth callbacks

6eb62b4

fix: reuse pending OAuth login and clarify auth contracts

f677332

linkdata added 14 commits November 5, 2026 01:44

fix: serialize OAuth starts and require verified profile admins

46dda49

fix: order auth events and simplify OAuth flow

914c3af

fix: preserve callback paths and defer logout safely

351cefd

fix(auth): tighten return targets and provider timeouts

254569a

Clarify shared JaWS locking, validate discovered metadata by its provider keys, and stabilize auth lifecycle tests. Pin gosec to an immutable revision.

fix(auth): renew nearly expired login flows

36b1a65

Return gateway errors for token exchange failures, clarify multi-provider setup and logout events, and simplify OAuth return handling.

fix(auth): share default rotation lock across providers

e5256aa

fix(auth): bind session claims to provider issuer

c763eb4

fix(auth): refresh early and simplify callback handling

6e5c988

fix(auth): stop old timer during login rotation

476fc8d

refactor: simplify auth timer and clarify provider guidance

df67b3d

test: cover stale auth timer and clarify session guidance

05fb2cc

test: cover linking revocation and callback limits

e542213

fix: bind OAuth flows to originating server

fc41b68

fix: prevent cross-provider OAuth redirect reuse

b65e0ba

linkdata merged commit 1748e00 into main Nov 5, 2026
3 checks passed

linkdata deleted the codex/feat/oauth2-provider-linking branch November 5, 2026 08:54

linkdata mentioned this pull request Nov 6, 2026

Reassess OAuth session rotation and its costs #22

Open

Navigation Menu

Repository navigation

feat: support OAuth2 profile sign-in and account linking - #21

feat: support OAuth2 profile sign-in and account linking#21
linkdata merged 43 commits into
mainfrom
codex/feat/oauth2-provider-linking

linkdata commented Nov 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

linkdata commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

linkdata commented Nov 4, 2026 •

edited

Loading