refactor(#6312): promote OIDC audience to shared const

[fullsend-ai-coder]

Summary

Introduces internal/mintcore/mintconsts package with OIDCAudience = "fullsend-mint" as a compile-time constant, replacing OIDC_AUDIENCE environment variable throughout the mint codebase.

• New package: internal/mintcore/mintconsts/ — dependency-free constants package shared by client and server
• Server: NewHandler no longer reads OIDC_AUDIENCE; VerifierFactory is niladic; NewJWKSVerifier/NewSTSVerifier default empty Audience to the constant
• Client: mintclient and CLI --audience flag both use mintconsts.OIDCAudience
• Deploy: GCF and CF provisioners stop writing OIDC_AUDIENCE env var; WIF allowedAudiences uses the constant
• Embed: New mintconsts package included in GCF bundle via embed sync
• Docs: Standalone mint guide and infrastructure reference updated to remove OIDC_AUDIENCE

Testing

• internal/mintcore/mintconsts/ — unit test verifies constant value
• internal/mintcore/ — all tests pass; empty-audience tests converted to default-to-const tests
• internal/mint/ — GCF wiring test passes without OIDC_AUDIENCE env
• cmd/mint/ — standalone mint tests pass without OIDC_AUDIENCE env
• internal/dispatch/gcf/ — provisioner tests pass; embed sync test updated for new file count
• internal/dispatch/cf/ — provisioner tests pass; OIDC_AUDIENCE env assertion updated
• internal/mintclient/ — tests pass with constant-backed default

---

Closes #6312

Post-script verification

• Branch is not main/master (agent/6312-oidc-audience-const)
• Secret scan passed (gitleaks — 05416e9141e64a5a46437ea19b8227884c1d2039..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:30 AM UTC · Completed 11:45 AM UTC

Commit: 9fab823 · View workflow run →

[github-actions]

Site preview

Preview: https://7dabe759-site.fullsend-ai.workers.dev

Commit: b965e38e9c528cf218acd8a69d2eb5935093fd7b

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Medium

• [stale reference to removed identifier] docs/contributing/go-code.md:41 — The Go coding guidelines recommend using the VerifierFactory pattern (with a cross-reference to internal/mintcore/), but this PR removes the VerifierFactory type entirely from internal/mintcore/handler.go. After merge, line 41 points developers to a pattern that no longer exists in the codebase.
  Remediation: Update the bullet point to describe the new pattern: load sites construct the concrete OIDCVerifier and pass it directly to NewHandler, rather than using a factory. Alternatively, generalize the guidance to recommend passing resolved values.

Previous run (2)

Looks good to me

Previous run (3)

Review

Findings

Low

• [const-vs-var consistency] internal/mintclient/mintclient.go:51 — var defaultAudience = mintconsts.OIDCAudience could be const defaultAudience = mintconsts.OIDCAudience. Since mintconsts.OIDCAudience is an untyped string const, const is valid Go and would preserve compile-time immutability. The var declaration is consistent with the file's existing pattern for testability (var httpClient, var envLookup) and no code currently mutates it, so the risk is negligible.
  Remediation: Use const defaultAudience = mintconsts.OIDCAudience.

Previous run (4)

Review

Findings

Low

• [fail-open / default-to-permissive] internal/mintcore/jwks_verifier.go — NewJWKSVerifier and NewSTSVerifier now default to mintconsts.OIDCAudience when opts.Audience is empty, replacing the previous construction-time error. The secondary runtime checks in Verify/prevalidate still reject empty audience at verification time, and mintconsts_test.go asserts the constant value, so the risk is negligible. See also: same pattern in internal/mintcore/sts_verifier.go.

• [const-vs-var consistency] internal/mintclient/mintclient.go:24 — const defaultAudience changed to var defaultAudience = mintconsts.OIDCAudience. Since mintconsts.OIDCAudience is an untyped string const, const defaultAudience = mintconsts.OIDCAudience is valid Go and would preserve compile-time immutability.
  Remediation: Use const defaultAudience = mintconsts.OIDCAudience.

---

Labels: PR modifies mint subsystem (mintcore, mintclient, mint dispatch, CLI mint commands) and is primarily Go code

[ifireball]

/fs-fix

#6315 introduced a WASM regression (~1.9 → ~3.0 MB gzip) by replacing the old empty-audience error check with a conditional default:

if opts.Audience == "" {
    opts.Audience = mintconsts.OIDCAudience
}

in NewJWKSVerifier and NewSTSVerifier. Entrypoints (especially cmd/mint-wasm/main.go) then stopped passing Audience, expecting the default to fill it. That if is a soft-migration leftover — it does not match #6312’s intent (“verifiers use mintconsts.OIDCAudience directly”).

Root cause: not const vs env. When WASM calls NewJWKSVerifier with compile-time-empty Audience and the constructor takes the default-success path, the generic init graph bloats. Const folding only helps when the compiler sees a non-empty audience at the call site, or when the const is used unconditionally / in Verify() (not via if opts.Audience == "").

Fix (spirit of #6312):

1. Remove the if opts.Audience == "" { opts.Audience = mintconsts... } branches from internal/mintcore/jwks_verifier.go and internal/mintcore/sts_verifier.go.
2. Stop treating Audience as configurable config — use mintconsts.OIDCAudience directly (either unconditionally in the constructor, or in Verify() / STS exchange; drop Audience from JWKSVerifierConfig / STSVerifierConfig if that’s cleaner).
3. Do not reintroduce OIDC_AUDIENCE env reads or mintEnv in verifier constructors.
4. Update tests: remove/replace EmptyAudience_DefaultsToConst tests; drop Audience: from verifier config literals where no longer needed.
5. Run make mint-embed-sync (or equivalent) for GCF embed copies; sync handler.go.embed comment if it still claims verifiers “read audience directly” via the default branch.
6. Verify: make wasm-build must report ~1.9 MB gzip (under 3 MB Free tier). Run make go-test for touched packages.

Do not “fix” by only adding Audience: mintconsts.OIDCAudience at the WASM call site while keeping the conditional default — remove the if entirely.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 12:26 PM UTC · Completed 12:46 PM UTC

Commit: 9fab823 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Addressed all 7 findings from the human instruction. Removed Audience field from JWKSVerifierConfig and STSVerifierConfig, eliminated conditional default branches, used mintconsts.OIDCAudience unconditionally in constructors. Updated all tests and synced GCF embed copies. WASM gzip size verified at ~1.93 MB (was ~3.0 MB with the conditional default).

Fixed (7):

1. Remove if opts.Audience == "" conditional default branches (internal/mintcore/jwks_verifier.go): Removed Audience field from JWKSVerifierConfig and the conditional default branch. Set audience directly to mintconsts.OIDCAudience in the constructor return value.
2. Remove if opts.Audience == "" conditional default branches (internal/mintcore/sts_verifier.go): Removed Audience field from STSVerifierConfig and the conditional default branch. Set oidcAudience directly to mintconsts.OIDCAudience in the constructor return value.
3. Update tests: remove/replace EmptyAudience_DefaultsToConst tests (internal/mintcore/jwks_verifier_test.go): Removed all Audience: from JWKSVerifierConfig literals. Replaced two EmptyAudience_DefaultsToConst tests with single AudienceIsConst test.
4. Update tests: drop Audience from verifier config literals (internal/mintcore/sts_verifier_test.go): Removed Audience from STSVerifierConfig literals. Renamed EmptyAudience_DefaultsToConst to AudienceIsConst.
5. Update tests: drop Audience from verifier config literals (internal/mintcore/handler_test.go): Removed all Audience: mintconsts.OIDCAudience and Audience: "fullsend-mint" from JWKSVerifierConfig and STSVerifierConfig literals. Removed unused mintconsts import.
6. Run mint-embed-sync for GCF embed copies (internal/dispatch/gcf/mintsrc/mintcore/jwks_verifier.go.embed): Synced embed copy from internal/mintcore/jwks_verifier.go. Verified with hack/lint-mint-embed-sync.
7. Run mint-embed-sync for GCF embed copies (internal/dispatch/gcf/mintsrc/mintcore/sts_verifier.go.embed): Synced embed copy from internal/mintcore/sts_verifier.go. Verified with hack/lint-mint-embed-sync.

Tests: passed

Decision points

• Chose to remove Audience from config structs entirely rather than just hardcoding it in the constructor while keeping the field (alternatives: Keep Audience field but ignore it, Keep Audience field but remove the conditional; rationale: Removing the field entirely is the cleanest approach per the human instruction ('drop Audience from JWKSVerifierConfig / STSVerifierConfig if that is cleaner'). It prevents any caller from passing a different audience value and ensures the compiler sees the const unconditionally.)

---

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:47 PM UTC · Completed 12:58 PM UTC

Commit: 99d4558 · View workflow run →

[ifireball]

/fs-fix the review comment - make the const a const!

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 1:05 PM UTC · Completed 1:11 PM UTC

Commit: 99d4558 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (human-triggered)

Addressed 1 review finding: changed var defaultAudience to const defaultAudience in mintclient.go, preserving compile-time immutability.

Fixed (1):

1. const-vs-var consistency: defaultAudience should be const (internal/mintclient/mintclient.go): Changed var defaultAudience to const defaultAudience since mintconsts.OIDCAudience is an untyped string constant and defaultAudience is never mutated

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:12 PM UTC · Completed 1:22 PM UTC

Commit: 1267838 · View workflow run →

[ifireball]

/fs-fix

VerifierFactory is leftover from when NewHandler needed a delayed constructor so it could inject OIDC audience (env / getEnv) into JWKS/STS verifiers. Audience is now mintconsts.OIDCAudience inside the constructors — the factory is a niladic func() (OIDCVerifier, error) that only wraps NewJWKSVerifier / NewSTSVerifier. Drop it and pass the verifier in.

1. Remove type VerifierFactory from internal/mintcore/handler.go. Change NewHandler to take oidcVerifier OIDCVerifier instead of verifierFactory VerifierFactory. Stop calling verifierFactory() inside NewHandler; store the passed verifier. Reject a nil verifier the same way getEnv is rejected. Update the NewHandler comment: load sites construct the verifier; the handler only does authz after Verify.

2. Load sites: instantiate the verifier, handle constructor errors at the call site, pass the verifier into NewHandler. Do not keep a local verifierFactory := func() ... wrapper.

   • cmd/mint/main.go (buildHandler) — NewJWKSVerifier(...) then NewHandler(os.Getenv, pemAccessor, verifier, httpClient)
   • cmd/mint-wasm/main.go — same with JWKS + fetchDoer
   • internal/mint/main.go (GCF) — NewSTSVerifier(...) then NewHandler(...)
   • cmd/mint/main_test.go, internal/mint/wiring_test.go — same pattern

3. Tests in mintcore:

   • mustNewHandler / newTestOIDCEnv in internal/mintcore/handler_test.go: pass the verifier directly; delete the factory := func() ... wrappers.
   • internal/mintcore/config_test.go: remove fakeFactory and TestNewHandler_CustomGetEnv_VerifierFactoryError (factory-error wrapping is gone). Pass verifiers into NewHandler.

4. make mint-embed-sync (or equivalent) so GCF copies match: internal/dispatch/gcf/mintsrc/mintcore/handler.go.embed and internal/dispatch/gcf/mintsrc/main.go.embed.

5. Verify: make go-test for touched packages; make wasm-build gzip stays ~1.9 MB (under 3 MB). Do not reintroduce Audience on JWKSVerifierConfig / STSVerifierConfig or OIDC_AUDIENCE env reads.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 1:54 PM UTC · Completed 2:12 PM UTC

Commit: 1267838 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 3 (human-triggered)

Addressed all 9 findings from the human instruction: removed VerifierFactory type, changed NewHandler to accept OIDCVerifier directly, updated all 4 load sites and their tests, synced embed files, and verified tests and WASM build pass. docs/contributing/go-code.md still references VerifierFactory pattern (not in scope).

Fixed (9):

1. Remove VerifierFactory type and change NewHandler signature (internal/mintcore/handler.go): Removed VerifierFactory type. Changed NewHandler to accept oidcVerifier OIDCVerifier directly instead of verifierFactory VerifierFactory. Removed verifierFactory() call inside NewHandler and added nil verifier check. Updated godoc to reflect that load sites construct the verifier.
2. Standalone load site: instantiate verifier at call site (cmd/mint/main.go): In buildHandler(), replaced verifierFactory closure with direct NewJWKSVerifier call and error handling. Pass constructed verifier into NewHandler.
3. WASM load site: instantiate verifier at call site (cmd/mint-wasm/main.go): In initMint(), replaced verifierFactory closure with direct NewJWKSVerifier call and error handling. Pass constructed verifier into NewHandler.
4. GCF load site: instantiate verifier at call site (internal/mint/main.go): In init(), replaced verifierFactory closure with direct NewSTSVerifier call and log.Fatalf on error. Pass constructed verifier into NewHandler.
5. Standalone test: remove factory wrapper (cmd/mint/main_test.go): In TestStandaloneWiring, replaced verifierFactory closure with direct NewJWKSVerifier call. Pass verifier into NewHandler.
6. GCF wiring test: remove factory wrapper (internal/mint/wiring_test.go): In TestInitWiring, replaced verifierFactory closure with direct NewSTSVerifier call. Pass verifier into NewHandler. Updated the 'starts without ALLOWED_ORGS' subtest as well.
7. Handler tests: pass verifier directly (internal/mintcore/handler_test.go): In mustNewHandler, removed factory := func() wrapper and pass verifier directly to NewHandler. In newTestOIDCEnv, replaced factory closure with direct NewJWKSVerifier call.
8. Config tests: remove fakeFactory, replace VerifierFactoryError test (internal/mintcore/config_test.go): Removed fakeFactory helper. Replaced TestNewHandler_CustomGetEnv_VerifierFactoryError with TestNewHandler_CustomGetEnv_NilVerifier. Updated all NewHandler call sites to pass verifier directly instead of through fakeFactory.
9. Embed sync for GCF copies (internal/dispatch/gcf/mintsrc/mintcore/handler.go.embed): Copied handler.go to handler.go.embed and main.go to main.go.embed to maintain GCF embed sync. Verified with hack/lint-mint-embed-sync.

Tests: passed

Decision points

• Replaced TestNewHandler_CustomGetEnv_VerifierFactoryError with TestNewHandler_CustomGetEnv_NilVerifier (alternatives: Delete the test entirely, Test with a verifier that returns errors on Verify; rationale: A nil-verifier rejection test preserves the analogous error path coverage that the factory-error test provided, matching the new nil check in NewHandler.)
• Did not update docs/contributing/go-code.md which references VerifierFactory pattern (alternatives: Update the docs reference, Leave it for a follow-up; rationale: The human instruction did not mention docs updates, and the scope guardrail says not to modify files the reviewer did not flag. The stale reference should be updated in a follow-up.)

---

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:14 PM UTC · Completed 2:24 PM UTC

Commit: e62f7a3 · View workflow run →

[ifireball]

/fs-fix

Review finding (medium): stale VerifierFactory docs after that type was removed.

docs/contributing/go-code.md:41 still says "Use the VerifierFactory pattern (see internal/mintcore/)" — that type no longer exists. Update that bullet to the current pattern: mint load sites construct the concrete OIDCVerifier (NewJWKSVerifier / NewSTSVerifier) and pass it directly into NewHandler. Do not recommend a factory/closure for audience or other runtime config; audience is mintconsts.OIDCAudience inside the constructors.

Grep for other VerifierFactory mentions under docs/ and update or remove them if any remain. No Go code changes.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 2:48 PM UTC · Completed 2:53 PM UTC

Commit: e62f7a3 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 4 (human-triggered)

Updated stale VerifierFactory documentation in docs/contributing/go-code.md to reflect the current pattern where load sites construct concrete OIDCVerifier instances and pass them directly to NewHandler. No other VerifierFactory mentions found under docs/.

Fixed (1):

1. stale VerifierFactory docs in go-code.md (docs/contributing/go-code.md): Replaced the stale 'Use the VerifierFactory pattern' bullet with current guidance: load sites construct a concrete OIDCVerifier (NewJWKSVerifier / NewSTSVerifier) and pass it directly into NewHandler. Audience comes from mintconsts.OIDCAudience inside the constructors. Grepped docs/ for other VerifierFactory mentions — none found.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:55 PM UTC · Completed 3:09 PM UTC

Commit: b965e38 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ❌ Failure · Started 4:23 PM UTC · Completed 4:23 PM UTC

Commit: b965e38 · View workflow run →