go-authcrunch: Skill for Codex

Authentication Portal OpenID Provider

Ownership

pkg/oidc owns the reusable provider. Provider is an exported concrete type; OpenIDProvider is its public HTTP and browser-lifecycle interface. NewProvider validates and snapshots Config, requires an IdentityVerifier, and accepts runtime Options. The package has no dependency on the authn portal runtime.

• config.go: public Config, ClientConfig, and validation.
• provisioning.go: public client constructors, credential generation, Config.AddClient, and dedicated signing-key generation in PEM or a new file.
• application.go: serializable OAuthApplicationConfig, associating an exact nickname with a validated client; NewOAuthApplicationConfig snapshots it without generating credentials. Root Config.OAuthApplications owns named registrations, with copying add/lookup methods in config_oauth_applications.go.
• pkg/oidc/parser: public NewOIDCClientConfigFromDirectives(nickname, statements) parses an OAuth application block body with cfgutil.DecodeArgs and returns *oidc.ClientConfig. This separate package owns the parser and its external-package unit tests; it delegates provisioning to oidc.NewClientConfig. NewOAuthApplicationConfigFromDirectives(header, statements, persisted) recognizes the encoded oauth application <nickname> header and reuses the same client field decoder for adaptation without credential generation. NewOIDCProviderConfigFromDirectives(statements, applications) parses provider settings, resolves selected application nicknames through a caller-owned map[string]*oidc.ClientConfig, and returns *oidc.Config for NewProvider or PortalConfig.OIDCProvider. Embedding adapters collect statements using cfgutil.EncodeArgs and import the parser directly. Keep the client, application, and provider entry points in client.go, application.go, and provider.go within this one parser package. Extend the matching entry point when exposing additional settings on its config; reuse the client decoder when adapting named applications.
• Root Config.ConfigureOIDCProvider(portal, statements) supplies registered applications to the provider parser, then calls PortalConfig.ConfigureOIDCProvider to attach a validated snapshot. A second definition fails; prior portal validation is invalidated so OIDC defaults run.
• identity.go: public Authentication, Identity, IdentityVerifier, and OpenIDProvider contracts.
• options.go: construction, runtime RenderPage callback, configurable login URL, cookie names, and excluded signing keys; provider.go: bounded sessions, consent, and browser lifecycle.
• keys.go: dedicated RSA PEM loading, thumbprints, public JWKS, signing, hints.
• http.go: public ServeHTTP, HandleHTTP, ValidateLoginRequest, and Discovery, guarded issuer routing, parsing, CORS, and buffered responses.
• pages.go, page.template: browser page snapshots, standalone rendering, content negotiation and CSP. The portal uses its oidc UI template alias; read browser pages and themes when changing consent, form-post continuation, browser errors or rendering integration.
• authorization.go, request_object.go, token.go: code/PKCE, consent, unsigned/RS256 Request Objects, client authentication, UserInfo, and revocation. claims.go owns claims permissions and ACR mapping; refresh.go owns OIDC refresh families; request_keys.go validates client verification keys.