feat(auth): rfc 0029 green (config) — auth.oidc section, coexistence rules, oidc-only enforced

[jensholdgaard]

First RFC 0029 green slice: scenario RFC0029.1 (config resolution) end to end.

• auth.oidc {issuer, audience, tenant_claim, name_claim} parses with ${env:…} substitution (schema arms in config::file, validation matrix in ourios_core::auth, mapping in src/main.rs, startup-observable arms against the spawned binary in tests/it/rfc0029_oidc.rs).
• Startup rules per the §5.1 contract: missing audience fails; an auth section with neither tokens nor oidc fails; an explicit tokens: [] fails unconditionally (the coexistence rule settled in docs(rfc): rfc 0029 — oidc bearer layer (issuer-agnostic, dex-validated), drafted #419 review); omitting tokens is the oidc-only shape (AuthSection.tokens became Option so absent ≠ empty).
• Invariant §3.7 / hazard posture: an oidc-only config serves with the gates enforced, never open — AuthConfig::enforcement_store() hands the listeners an empty store (every bearer 401s) until the verifier slice teaches the gates the full config and retires the bridge. The it-test asserts the 401 on a real socket and that no open-mode warning is emitted. Open mode (no auth section) is byte-for-byte unchanged.
• ourios_core::auth grows OidcSpec/OidcConfig/AuthConfig + build_auth_config / build_oidc_config; RFC 0026's build_token_store rules are unchanged (its empty-list error message now points at the oidc-only alternative).

Verified locally: cargo fmt --check, clippy -D warnings (all targets/features), full workspace suite 965/965 (30 skipped = the #[ignore]d red stubs + known-manual tests).

Next slices: verifier (fixture issuer, .2/.6), binding (.3–.5), Dex acceptance (.7).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Authentication settings now support both static bearer tokens and OIDC configuration.
  • OIDC-only setups are now accepted, while still enforcing requests as closed by default.

• Bug Fixes

  • Improved validation messages for incomplete authentication settings.
  • Empty token lists now produce clearer errors, especially in OIDC-enabled configurations.
  • Added coverage for startup validation and request handling with OIDC-only authentication.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds RFC 0029 OIDC configuration alongside existing RFC 0026 bearer token auth. Core introduces OidcSpec/OidcConfig/AuthConfig types with validation and an enforcement_store method. Server config schema makes tokens optional and adds an oidc section. Server auth mapping and main.rs wiring are updated to resolve and use AuthConfig, and new integration tests cover OIDC-only startup and enforcement behavior.

Changes

OIDC-aware auth resolution

Layer / File(s)	Summary
Core auth resolution types and logic crates/ourios-core/src/auth.rs	Adds OidcSpec, OidcConfig, AuthConfig types, build_auth_config/build_oidc_config functions, enforcement_store method, adjusted validation error text, and new unit tests.
Server config schema for optional tokens and OIDC section crates/ourios-server/src/config/file.rs	Changes AuthSection.tokens to Option<Vec<TokenEntry>>, adds OidcSection, updates token reference validation and env-substitution to handle optional tokens and OIDC fields, and updates related tests.
Server auth mapping to AuthConfig crates/ourios-server/src/auth.rs	Replaces build_token_store with build_auth_config, translating server config tokens/oidc sections into core specs and delegating resolution to core; updates re-exports and tests.
Server startup wiring using AuthConfig crates/ourios-server/src/main.rs	Changes ServerConfig.auth to Option<AuthConfig>, adds enforcement_store helper, updates receiver/querier construction and tests to derive TokenStore from AuthConfig.
RFC 0029 integration tests crates/ourios-server/tests/it/rfc0029_oidc.rs	Replaces ignored stub with startup-failure and OIDC-only enforcement tests spawning the server binary and verifying stderr/HTTP 401 behavior.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
    participant MainRs as main.rs
    participant ServerAuth as server::auth
    participant CoreAuth as core::auth
    participant Listener as OTLP/Querier

    MainRs->>ServerAuth: build_auth_config(file.auth)
    ServerAuth->>CoreAuth: build_auth_config(tokens, oidc)
    CoreAuth-->>ServerAuth: AuthConfig (tokens + oidc)
    ServerAuth-->>MainRs: Option<AuthConfig>
    MainRs->>MainRs: enforcement_store(&config)
    MainRs->>CoreAuth: auth.enforcement_store()
    CoreAuth-->>MainRs: Option<Arc<TokenStore>>
    MainRs->>Listener: construct with auth = enforcement_store
    Listener->>CoreAuth: authenticate(bearer)
    CoreAuth-->>Listener: match or none (401)

Loading

Possibly related PRs

• jensholdgaard/ourios#390: Extends the same build_token_store-to-build_auth_config migration and server auth wiring that this PR builds upon.
• jensholdgaard/ourios#398: Changes listener pipelines to enforce bearer auth using the resolved TokenStore now derived via AuthConfig::enforcement_store().
• jensholdgaard/ourios#408: Modifies QuerierConfig.auth derivation from resolved auth config, aligning with the enforcement_store() wiring introduced here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is specific and matches the auth/OIDC config resolution changes in the PR.
Description check	✅ Passed	The description covers the main summary, RFC context, behavior changes, and validation notes, though it doesn't use the template headings verbatim.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rfc0029-green-config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Implements the first “green” slice of RFC 0029 (scenario RFC0029.1) by adding config/schema support for an auth.oidc section, enforcing the RFC coexistence rules between static tokens and OIDC, and ensuring oidc-only configs start in enforced (not open) mode via an empty enforcement store bridge.

Changes:

• Add auth.oidc schema + ${env:…} substitution support, and make auth.tokens optional to distinguish omitted vs explicitly empty.
• Introduce core OidcSpec/OidcConfig and AuthConfig with build_auth_config + validation rules (missing audience, neither-half configured, explicit tokens: [] always invalid).
• Wire server startup to pass the enforcement store derived from AuthConfig, plus add end-to-end integration tests asserting startup failures and oidc-only enforced behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/ourios-server/tests/it/rfc0029_oidc.rs	Converts RFC0029.1 stub into integration tests covering startup validation errors and oidc-only enforced serving.
crates/ourios-server/src/main.rs	Switches from TokenStore to AuthConfig in resolved config, adds enforcement_store() adapter, and updates mapping tests.
crates/ourios-server/src/config/file.rs	Extends file schema with auth.oidc and changes auth.tokens to Option<Vec<_>> to support oidc-only shape.
crates/ourios-server/src/auth.rs	Adds build_auth_config mapping from file schema into core AuthConfig (static tokens + optional OIDC spec).
crates/ourios-core/src/auth.rs	Introduces OIDC spec/config + auth config validation, plus the enforcement-store bridge behavior for oidc-only configs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.