feat: implement OIDC authentication for admin users - #316

🛡️ Security Analysis - APPROVED

Token Validation (internal/api/handlers/v0/auth/oidc.go:93-140)

• ✅ Proper OIDC token verification using go-oidc library
• ✅ Signature verification against provider's JWKS endpoint
• ✅ Standard claims validation (iss, sub, aud, exp, nbf, iat)
• ✅ Extra claims validation for domain restriction (hd: modelcontextprotocol.io)

State Management (internal/api/handlers/v0/auth/oidc.go:318-372)

• ✅ CSRF protection with cryptographically secure state/nonce generation
• ✅ Session timeout (5 minutes) to prevent replay attacks
• ✅ Proper session cleanup after callback processing
• ✅ Uses crypto/rand for secure random string generation

Authorization Flow (internal/api/handlers/v0/auth/oidc.go:349-372)

• ✅ Standard OAuth2 authorization code flow implementation
• ✅ Proper redirect URI validation
• ✅ ID token extraction and validation from token response

🏗️ Architecture Review - APPROVED

Interface Design (internal/api/handlers/v0/auth/oidc.go:48-53)

• ✅ Clean GenericOIDCValidator interface allows for testing and extensibility
• ✅ Proper separation between validation logic and HTTP handlers
• ✅ Testable design with dependency injection support

Error Handling

• ✅ Consistent error wrapping with descriptive messages
• ✅ Proper HTTP status codes (401 for auth failures, 400 for bad requests)
• ✅ No sensitive information leakage in error messages

Permission System (internal/api/handlers/v0/auth/oidc.go:404-434)

• ✅ Configurable permissions via environment variables
• ✅ Wildcard support for admin access patterns
• ✅ Integration with existing JWT claims structure

🧪 Test Coverage Review - APPROVED

Test Structure (internal/api/handlers/v0/auth/oidc_test.go)

• ✅ Well-structured mock implementation for testing
• ✅ Tests cover both success and failure scenarios
• ✅ Domain validation testing (correct vs incorrect hosted domain)
• ✅ Authorization URL generation testing

Test Cases Coverage:

• ✅ Token exchange with valid Google Workspace domain
• ✅ Token validation failure with wrong domain
• ✅ Authorization flow initiation
• ✅ Mock validator properly implements interface

⚙️ Configuration Review - APPROVED

Environment Variables (.env.example:34-44, internal/config/config.go:30-37)

• ✅ Comprehensive OIDC configuration options
• ✅ Proper defaults and documentation
• ✅ Secure handling of client secrets
• ✅ Flexible permission configuration

Deployment Integration (deploy/pkg/k8s/registry.go:131-155)

• ✅ Production-ready Kubernetes configuration
• ✅ Proper secret management for sensitive values
• ✅ Environment-specific configuration
• ✅ Health checks and probes configured

📚 Documentation Review - APPROVED

Architecture Documentation (docs/architecture.md:212-248)

• ✅ Clear sequence diagram showing OIDC flow
• ✅ Practical usage examples with gcloud CLI
• ✅ Integration with overall system architecture

🔍 Potential Improvements

1. Session Storage (internal/api/handlers/v0/auth/oidc.go:179)

   • Current in-memory session storage works for single instance
   • Consider Redis/database for multi-replica deployments
   • Not blocking for current deployment model

2. Rate Limiting

   • Consider adding rate limiting on OIDC endpoints
   • Prevent brute force attacks on state parameters
   • Low priority given admin-only usage

3. Audit Logging

   • Consider structured logging for OIDC auth events
   • Helpful for security monitoring and compliance
   • Enhancement for future iterations

4. Token Refresh

   • Current implementation uses ID tokens (short-lived)
   • Could consider refresh token support for longer sessions
   • Not critical for CLI-based admin usage