Feature 03 integration fix: sanitize discovery errors and narrow CSRF exemption #25

2026-10-03T11:12:05-04:00

dev_agent commented

2026-10-03 11:12:05 -04:00

Addresses feature-review findings F03-01 and F03-02 on feature PR #24 (head 5833a735).

F03-01: OIDC discovery errors are sanitized so a provider's non-200 response body cannot reach the startup log; test with a sentinel body.
F03-02: CSRF middleware exempts only GET; HEAD and OPTIONS under /api/v1 without X-MealQuest-CSRF now get 403 {"error":{"code":"csrf"}}; tests updated.

Evidence: gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok. Tests shown to fail with each old code path restored.

Base: feature/9c4eba48-...-authentik-oidc-sessions (5833a735).

Addresses feature-review findings F03-01 and F03-02 on feature PR #24 (head 5833a735). F03-01: OIDC discovery errors are sanitized so a provider's non-200 response body cannot reach the startup log; test with a sentinel body. F03-02: CSRF middleware exempts only GET; HEAD and OPTIONS under /api/v1 without X-MealQuest-CSRF now get 403 {"error":{"code":"csrf"}}; tests updated. Evidence: gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok. Tests shown to fail with each old code path restored. Base: feature/9c4eba48-...-authentik-oidc-sessions (5833a735).

dev_agent added 1 commit 2026-10-03 11:12:06 -04:00

Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS

Independent review Codex gpt-6-sol high: APPROVED (0 findings)

Details

CI / ci (pull_request) Successful in 1m26s

Details

CI / ci (push) Successful in 1m26s

Details

e73ebe2f2f

F03-01: go-oidc embeds the provider's response body in its error for a
non-200 discovery response, which cmd/server logged at startup. Discovery
now runs through a status-recording transport and a non-200 response is
reported as "provider answered HTTP <status>" only; transport errors keep
their cause. A test with a sentinel body proves it reaches neither the
error nor the log.

F03-02: the CSRF middleware exempts only GET, so HEAD and OPTIONS under
/api/v1 without X-MealQuest-CSRF get 403 csrf, matching CONTEXT.MD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-03 11:13:26 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: e73ebe2f2fb8a352dad239c1331e14a21daabd7c

{
  "verdict": "APPROVED",
  "reviewed_sha": "e73ebe2f2fb8a352dad239c1331e14a21daabd7c",
  "summary": "Both fixes are verified. A non-200 OIDC discovery response returns a status-only error, and the sentinel-body test would fail with the old error wrapping. Only GET bypasses CSRF; HEAD and OPTIONS without the header receive 403 csrf. Session authentication still runs first, and the constant-time comparison remains. No dependency or cmd/server change was introduced. gofmt, go vet, and go test -race -count=1 ./... passed.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `e73ebe2f2fb8a352dad239c1331e14a21daabd7c` ```json { "verdict": "APPROVED", "reviewed_sha": "e73ebe2f2fb8a352dad239c1331e14a21daabd7c", "summary": "Both fixes are verified. A non-200 OIDC discovery response returns a status-only error, and the sentinel-body test would fail with the old error wrapping. Only GET bypasses CSRF; HEAD and OPTIONS without the header receive 403 csrf. Session authentication still runs first, and the constant-time comparison remains. No dependency or cmd/server change was introduced. gofmt, go vet, and go test -race -count=1 ./... passed.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit 88f7d0a5fa into feature/9c4eba48-9a49-4b73-a85f-a4bc19eb4062-authentik-oidc-sessions

2026-10-03 11:22:57 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#25

Feature 03 integration fix: sanitize discovery errors and narrow CSRF exemption #25

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high