quality(coverage): measure OIDC verification core

[seonghobae]

Purpose

Advance issue #84 from current protected main with a bounded OIDC verification coverage/security slice. This PR keeps the OIDC JWT verification core inside owned-production coverage and closes realistic upstream-document and claim-validation branches without restoring broad V8 exclusions or weakening the 100% coverage gate.

Current exact state

• branch: quality/oidc-core-coverage-slice
• protected/live base: 56fde1865bd8e1ab4798d1650632ba71ba9f5b1c
• exact current head: 378e8fc76e18d7beb635e75bd97a417247d146f2
• Draft remains intentional.
• predecessor-head checks/reviews do not transfer.
• current formal reviews: none at the latest pre-write refetch.

Coverage and reliability work

The slice removes only the broad V8 exclusion around base64UrlDecode, base64UrlEncode, decodeJson, fetchGithubOidcKeys, and verifyGithubOidcJwt. Executable public /exchange regressions now cover or harden:

• malformed/non-success OIDC discovery and JWKS responses;
• non-string, empty, and off-origin jwks_uri values;
• malformed/null/non-array JWKS documents;
• discovery/JWKS transport rejection and expired JWKS cache refetch;
• audience-array and workflow_ref fallback handling;
• missing kid, missing signing keys with forced refresh, invalid signatures, future nbf, missing exp, missing workflow ref, malformed payload JSON, workflow-repository mismatch, and unexpected verifier failure.

Test-first JWKS entry-shape repair

Exact head ecfaecad75dc14794151a7866ccd0143449c59ba still failed application release verify after the residual-branch regressions, while reviewer-ci and Security Scan succeeded. During the next RCA pass, source inspection exposed a separate Noema-owned reliability/security classification defect: fetchGithubOidcKeys accepted any array as keys, so a malformed upstream document such as { "keys": [null] } reached key.kid, raised TypeError, and was misclassified by the JWT catch boundary as client ERR_TOKEN_MALFORMED instead of an upstream OIDC document failure.

• RED: b77ee98b8180e077df2d36626eb19de80187c1b4 adds a public-path regression requiring malformed JWKS key entries to fail closed as HTTP 502 / ERR_OIDC_VERIFICATION before key selection.
• GREEN: 378e8fc76e18d7beb635e75bd97a417247d146f2 validates every JWKS key entry as a plain JSON object before caching/selection and preserves the existing valid-key path. The GREEN commit changes only three production lines in src/index.ts relative to the RED head.

No source behavior outside this upstream schema boundary, coverage threshold, or central security gate was weakened.

Evidence boundary

Fresh exact-head workflows for 378e8fc76e18d7beb635e75bd97a417247d146f2 were queued at the first post-write refetch:

• application CI 31993727469: queued;
• reviewer-ci 31993727486: queued;
• central Security Scan 31993727453: queued.

Queued/pending evidence is non-passing. Keep Draft and do not merge until the unchanged exact head has terminal-success application CI plus every applicable live central Security/review/governance gate and zero valid unresolved findings. If application CI still fails, identify the new exact first failing boundary before another repair; do not restore broad coverage exclusions or weaken thresholds.

Related: #84.

Summary by CodeRabbit

• 개선 사항

  • GitHub OIDC Discovery 및 JWKS 검증을 강화했습니다.
  • 네트워크 오류, 잘못된 JSON, 유효하지 않은 키와 신뢰할 수 없는 주소를 안전하게 처리합니다.
  • OIDC 검증 실패 시 명확한 오류와 HTTP 502 응답을 제공합니다.
  • JWKS 캐시 만료 후 키 정보를 자동으로 갱신합니다.

• 테스트

  • JWT 서명, 만료, 발급자·대상·저장소·워크플로 검증 시나리오를 확대했습니다.
  • 다양한 OIDC 업스트림 오류 및 비정상 키 형식을 검증합니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cebfd5e-0437-4451-a514-0ce9146248ef

📥 Commits

Reviewing files that changed from the base of the PR and between 56fde18 and 43af290.

📒 Files selected for processing (7)

• src/index.ts
• test/coverage-ignore-operational-helpers.test.ts
• test/oidc-jwks-cache-expiry.test.ts
• test/oidc-jwks-key-shape.test.ts
• test/oidc-upstream-failure-contract.test.ts
• test/oidc-upstream-network-failure-contract.test.ts
• test/oidc-verification-residual-coverage.test.ts

---

📝 Walkthrough

Walkthrough

GitHub OIDC discovery와 JWKS 검증이 네트워크, JSON, 구조, URI 오류를 처리하도록 변경되었습니다. JWT 오류 분류와 JWK import 오류 처리를 조정했습니다. 캐시 만료, 키 구조, JWT 검증 분기를 검증하는 테스트를 추가했습니다.

Changes

OIDC 검증 강화

Layer / File(s)	Summary
OIDC 업스트림 및 JWT 오류 처리 src/index.ts	Discovery와 JWKS 응답의 네트워크, JSON, 구조, 신뢰 URI를 검증합니다. JWK import 실패를 ERR_OIDC_VERIFICATION으로 변환합니다. SyntaxError만 malformed 토큰으로 분류합니다.
업스트림 실패 계약 검증 test/oidc-upstream-failure-contract.test.ts, test/oidc-upstream-network-failure-contract.test.ts	Discovery와 JWKS의 HTTP 실패, 네트워크 실패, JSON 오류, URI 오류, 구조 오류가 HTTP 502와 ERR_OIDC_VERIFICATION을 반환하는지 검증합니다.
JWKS 캐시 및 키 구조 검증 test/oidc-jwks-cache-expiry.test.ts, test/oidc-jwks-key-shape.test.ts	유효한 캐시를 재사용하고 TTL 만료 후 discovery와 JWKS를 다시 요청하는지 검증합니다. null 또는 불완전한 RSA 키 항목을 거부하는지 검증합니다.
JWT 검증 분기 및 커버리지 test/oidc-verification-residual-coverage.test.ts, test/coverage-ignore-operational-helpers.test.ts	JWT claims, 헤더, 서명, workflow 제한, malformed 토큰, verifier 예외의 처리 결과를 검증합니다. 운영 헬퍼 커버리지 목록과 파일 종료 줄바꿈 검사를 추가합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ExchangeEndpoint
  participant GitHubOIDC
  participant JWTVerifier
  ExchangeEndpoint->>GitHubOIDC: discovery 문서 요청
  GitHubOIDC-->>ExchangeEndpoint: 검증된 jwks_uri 반환
  ExchangeEndpoint->>GitHubOIDC: JWKS 요청
  GitHubOIDC-->>ExchangeEndpoint: 검증된 keys 반환
  ExchangeEndpoint->>JWTVerifier: JWK와 JWT 서명 검증
  JWTVerifier-->>ExchangeEndpoint: 검증 결과 반환

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch quality/oidc-core-coverage-slice

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.