Merge remote-tracking branch 'origin/main' into feat/huma-api-docs

backend/internal/oidc/module.go

@@ -15,9 +15,10 @@ import (
 )
 
 type Config struct {
-	BaseURL      string
-	TokenBaseURL string
-	Secret       []byte
+	BaseURL                   string
+	TokenBaseURL              string
+	Secret                    []byte
+	AllowInsecureCallbackURLs bool
 }
 
 type TokenSigner interface {

backend/internal/oidc/provider.go

@@ -49,6 +49,7 @@ func newProvider(store *Store, authenticator *federatedClientAuthenticator, sign
 		IgnoreUnknownScopes:                     true,
 		AudienceMatchingStrategy:                fosite.ExactAudienceMatchingStrategy,
 		RedirectURIMatcher:                      matchRedirectURI,
+		RedirectSecureChecker:                   redirectSecureChecker(config.AllowInsecureCallbackURLs),
 		EnforcePKCEForPublicClients:             true,
 		EnablePKCEPlainChallengeMethod:          true,
 		SupportedRequestObjectSigningAlgorithms: []string{"none"},
@@ -111,6 +112,17 @@ func newProvider(store *Store, authenticator *federatedClientAuthenticator, sign
 	}, nil
 }
 
+func redirectSecureChecker(allowInsecureCallbackURLs bool) func(context.Context, *url.URL) bool {
+	return func(ctx context.Context, redirectURI *url.URL) bool {
+		if allowInsecureCallbackURLs || fosite.IsRedirectURISecure(ctx, redirectURI) {
+			return true
+		}
+
+		slog.InfoContext(ctx, "HTTP callback URL rejected; set ALLOW_INSECURE_CALLBACK_URLS=true to allow it", "callback_url", redirectURI.Redacted())
+		return false
+	}
+}
+
 func matchRedirectURI(rawurl string, client fosite.Client) (*url.URL, error) {
 	redirectURI, err := fosite.MatchRedirectURIWithClientRedirectURIs(rawurl, client)
 	if err == nil || rawurl == "" {

backend/internal/oidc/provider_test.go

@@ -11,6 +11,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -85,6 +86,70 @@ func TestProviderIssuesJWTAccessTokens(t *testing.T) {
 	require.Equal(t, "test-key-id", header["kid"])
 }
 
+func TestRedirectSecureChecker(t *testing.T) {
+	loopbackRedirectURI, err := url.Parse("http://127.0.0.1:49813/callback")
+	require.NoError(t, err)
+
+	checker := redirectSecureChecker(false)
+	require.True(t, checker(t.Context(), loopbackRedirectURI))
+}
+
+func TestProviderInsecureCallbackURLCompatibility(t *testing.T) {
+	tests := []struct {
+		name                      string
+		allowInsecureCallbackURLs bool
+		expectSuccess             bool
+	}{
+		{
+			name:                      "allows HTTP callback URLs when compatibility is enabled",
+			allowInsecureCallbackURLs: true,
+			expectSuccess:             true,
+		},
+		{
+			name:                      "rejects HTTP callback URLs when compatibility is disabled",
+			allowInsecureCallbackURLs: false,
+			expectSuccess:             false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db := testutils.NewDatabaseForTest(t)
+			signerKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			require.NoError(t, err)
+			require.NoError(t, db.Create(&model.OidcClient{
+				Base:         model.Base{ID: "test-client"},
+				Name:         "Test Client",
+				CallbackURLs: model.UrlList{"http://client.example.com/callback"},
+			}).Error)
+
+			provider, err := newProvider(NewStore(db, nil), nil, testTokenSigner{key: signerKey}, Config{ //nolint:gosec // static test-only provider secret
+				BaseURL:                   "https://issuer.example.com",
+				TokenBaseURL:              "https://issuer.example.com",
+				Secret:                    []byte("test-secret"),
+				AllowInsecureCallbackURLs: tt.allowInsecureCallbackURLs,
+			})
+			require.NoError(t, err)
+
+			req := httptest.NewRequestWithContext(
+				t.Context(),
+				http.MethodGet,
+				"/api/oidc/authorize?client_id=test-client&response_type=code&scope=openid&state=state-with-enough-entropy&redirect_uri=http://client.example.com/callback",
+				nil,
+			)
+			authorizeRequest, err := provider.NewAuthorizeRequest(req.Context(), req)
+			require.NoError(t, err)
+
+			_, err = provider.NewAuthorizeResponse(t.Context(), authorizeRequest, NewEmptySession())
+			if tt.expectSuccess {
+				require.NoError(t, err)
+			} else {
+				require.ErrorIs(t, err, fosite.ErrInvalidRequest)
+			}
+		})
+	}
+}
+
 func TestProviderAcceptsWildcardRedirectURI(t *testing.T) {
 	db := testutils.NewDatabaseForTest(t)
 	signerKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)