feat(identity): wire OAuth callbacks into runtime

[seonghobae]

Summary

Continues issue #18 by publishing the provider callback routes and wiring the callback application to production runtime dependencies.

• publishes fixed Google and GitHub callback endpoints
• binds the provider, bounded query, browser cookie, and correlation header to callback completion
• returns only a no-store 303 redirect with the opaque Secure/HttpOnly application session cookie
• maps callback and internal failures to stable credential-free problem responses
• wires PostgreSQL-backed OAuth state, sessions, and atomic external-identity provisioning
• adds a transactional PostgreSQL adapter for first-sign-in provisioning
• constructs the fixed Google OIDC and GitHub OAuth clients from required startup credentials
• emits structured credential-free callback audit records
• injects the callback application into the NestJS controller through an explicit runtime token
• adds controller/runtime tests and the implementation plan

Validation gate

Merge only after formatting, type checking, tests, build, AppGuardrail, Semgrep, Security Scan, Commercial Readiness, CodeRabbit, and all human/security review feedback complete on the exact current head with no actionable finding.

Part of #18.

Summary by CodeRabbit

• 새 기능
  • Google 및 GitHub OAuth 콜백 엔드포인트를 추가했습니다.
  • 콜백 요청의 상관관계 ID를 검증하고, 잘못된 값은 안전하게 대체합니다.
  • OAuth 인증 실패와 일시적 서버 오류를 구분해 적절한 오류 응답을 제공합니다.
  • OAuth 콜백 처리 및 타임스탬프 감사 기록을 지원합니다.
• 문서
  • OAuth 콜백 라우팅, 보안, 오류 처리 및 감사 로깅 계획을 문서화했습니다.
• 버그 수정
  • 필수 OAuth 설정 누락과 잘못된 요청 타임아웃을 시작 단계에서 검증합니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a79503a8-fe5f-46a6-b86a-acf33ae6bb2f

📥 Commits

Reviewing files that changed from the base of the PR and between 9f45178 and 76f5fde.

📒 Files selected for processing (6)

• apps/identity-service/src/identity-runtime.test.ts
• apps/identity-service/src/identity-runtime.ts
• apps/identity-service/src/oauth-callback-application.test.ts
• apps/identity-service/src/oauth-callback-application.ts
• apps/identity-service/src/oauth-http-controller.test.ts
• apps/identity-service/src/oauth-http-controller.ts

📝 Walkthrough

Walkthrough

Google 및 GitHub OAuth 콜백 라우트를 추가했습니다. 런타임은 제공자 클라이언트, ID 서비스, 감사 sink와 callback application을 구성합니다. NestJS는 callback application을 컨트롤러에 주입합니다.

Changes

OAuth 콜백 런타임

Layer / File(s)	Summary
런타임 구성 및 감사 apps/identity-service/src/identity-runtime.ts, apps/identity-service/src/identity-runtime.test.ts	트랜잭션 SQL 클라이언트와 JSON 감사 sink를 추가했습니다. Google·GitHub 자격 증명, redirect URI, 요청 timeout을 검증합니다. OAuth 제공자 클라이언트와 callback application을 런타임에 구성합니다.
콜백 컨트롤러 처리 apps/identity-service/src/oauth-http-controller.ts, apps/identity-service/src/oauth-http-controller.test.ts	Google·GitHub 콜백 라우트를 추가했습니다. correlation ID를 정규화하고 callback application 결과를 응답으로 변환합니다. 인증 오류는 400, 기타 오류는 503으로 반환합니다.
NestJS 런타임 주입 apps/identity-service/src/main.ts, docs/superpowers/plans/2026-08-03-oauth-callback-runtime-wiring-slice.md, package.json	IDENTITY_RUNTIME의 callback application을 OAUTH_CALLBACK_APPLICATION 토큰으로 제공합니다. 런타임 배선 계획을 추가하고 format 검사 대상에 포함했습니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OAuthProvider
  participant OAuthHttpController
  participant OAuthCallbackApplication
  participant Browser
  OAuthProvider->>OAuthHttpController: callback query와 cookie 전달
  OAuthHttpController->>OAuthCallbackApplication: provider, query, cookie, correlation ID 전달
  OAuthCallbackApplication-->>OAuthHttpController: 상태, redirect, cookie 반환
  OAuthHttpController-->>Browser: no-store 응답과 보안 cookie 반환

Loading

Possibly related issues

• Complete Google and GitHub OAuth callbacks with secure browser sessions #18 — Google·GitHub OAuth 콜백 런타임 배선과 감사 동작을 직접 구현합니다.

Possibly related PRs

• ContextualWisdomLab/life-os#22 — 기존 OAuth HTTP 경계에 callback application과 콜백 라우트를 연결합니다.
• ContextualWisdomLab/life-os#25 — BoundedOAuthProviderHttpClient를 런타임에 통합하고 timeout 검증을 추가합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Google 및 GitHub OAuth 콜백을 프로덕션 런타임에 연결하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oauth-callback-runtime-wiring

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/identity-service/src/identity-runtime.ts`:
- Around line 288-328: Update OAuthCallbackApplication.completeAuthorization so
the success audit record uses auditWithoutThrowing, matching the failure path
and preventing audit sink I/O errors from revoking the issued session or turning
successful authentication into failure.
- Around line 288-328: Update the error handling around
OAuthCallbackApplication.completeAuthorization so only expected authentication
failures are converted through failAuthentication() and returned as 400
responses. Preserve callbackCorrelationId and requireCorrelationId validation
compatibility, while allowing transaction, database, provider, and audit errors
to retain a distinct internal/service-error type that the callback endpoint maps
to HTTP 503.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e72c665-6454-4de0-82b6-c711eafabd30

📥 Commits

Reviewing files that changed from the base of the PR and between 014a4e4 and 9f45178.

📒 Files selected for processing (7)

• apps/identity-service/src/identity-runtime.test.ts
• apps/identity-service/src/identity-runtime.ts
• apps/identity-service/src/main.ts
• apps/identity-service/src/oauth-http-controller.test.ts
• apps/identity-service/src/oauth-http-controller.ts
• docs/superpowers/plans/2026-08-03-oauth-callback-runtime-wiring-slice.md
• package.json