auth-providers: OIDC callback hardening

[MichaelUray]

Summary

Hardens OIDC startup and callback handling, and makes ADMIN_EMAILS parsing
safe while preserving existing login-id configurations by default.

• Retry OIDC issuer discovery and strategy registration with capped backoff so
  a temporary IdP outage cannot leave the service permanently without the
  oidc Passport strategy.
• Return 503 with Retry-After while OIDC login is initializing.
• Make every OIDC callback failure redirect to /login rather than returning a
  500; synchronous Passport failures and rejected middleware promises are
  handled as well as callback errors and missing users.
• Pass an email to the shared provider-login path only after the provider has
  confirmed it: OIDC and Google use email_verified, while GitHub requires a
  primary, verified address from its emails API.
• Abort a pending OIDC registration retry during account-service shutdown.
• Normalize ADMIN_EMAILS, ignore empty values, flag malformed email-shaped
  values, and make ADMIN_EMAILS_STRICT=TRUE equivalent to true.

Compatibility and operational notes

ADMIN_EMAILS entries that are not valid email-shaped values are retained by
default for compatibility with deployments using login IDs such as admin.
They are warned about at startup. Set ADMIN_EMAILS_STRICT=true (case
insensitive) to drop them.

The admin decision is made by the shared account login helper, which both the
MongoDB and PostgreSQL account paths use; this is not a PostgreSQL-only code
path.

The callback query markers (oidc_callback_failed and oidc_no_account) are
diagnostic markers. The current login UI does not render them yet; surfacing a
user-facing message belongs in a small LoginApp.svelte follow-up.

Verification

• pods/authProviders: openid.test.ts, providerEmailVerification.test.ts
• server/account: adminEmails.test.ts

[huly-github-staging]

Connected to Huly®: UBERF-16534

[MichaelUray]

@ArtyomSavchenko friendly ping on this one: the ADMIN_EMAILS behaviour is back to the original semantics with the strict mode as opt-in (see my reply above), and the branch still merges cleanly into develop. Let me know if you'd like the OIDC retry part split out or changed.

[ArtyomSavchenko]

@MichaelUray Please take a look at review comments:

Blocking

1. Possible request hang in the callback wrapper

The wrapper is:

await new Promise<void>((resolve) => {
  passport.authenticate('oidc', { failureRedirect: loginUrl }, (err, user, info, status) => {
    ...
    resolve()
  })(ctx, async () => {})
})

• The promise returned by the middleware call is discarded, and the executor only ever calls resolve.
• If the middleware rejects without invoking the callback, the request hangs forever and the rejection goes unhandled.
• Because nothing can reject, the outer try/catch is partly dead code.
  This matters most while the strategy is still being registered. /auth/openid/callback has no oidcReady check, so a callback that arrives before registration finishes hits passport with an unregistered 'oidc' strategy ("Unknown authentication strategy").

Suggested fix: pass reject through and attach .catch(reject) to the middleware call (or restructure to await authenticate(...) with a callback that records the result). Alternatively, give the callback route the same readiness check as the login route.

2. The headline fix has no test

Every test in openid.test.ts covers the retry helper and the 503 wiring. Nothing covers the callback guarantees:

• all failures → 302 /login?error=oidc_callback_failed, never 500
• the oidc_no_account redirect
• the path where handleProviderAuth throws
  A test with a fake passport that (a) calls back with an error, (b) calls back with no user, and (c) throws would pin this down.

Non-blocking

• Admin lookup. parseAdminEmails / isAdminEmail are well covered, and keeping no-@ entries by default addresses ArtyomSavchenko's comment, with ADMIN_EMAILS_STRICT as an opt-in. Two things to confirm:
  • Callers should pass a verified email. Case-insensitive matching widens what matches, and a bare admin entry matches whatever a provider puts in that field.
  • The PR says Postgres lacked the hardening, but the diff only touches the shared helper. Make sure the Postgres path really goes through it.
• Weak @ check. bar@@ counts as an email and is kept silently (test 4 asserts this). includes('@') is a loose test if the goal is typo visibility.
• ADMIN_EMAILS_STRICT parsing. Only the exact string 'true' enables it; TRUE or 1 are silently ignored (test 4e locks this in). An operator who sets TRUE will believe they enabled fail-closed mode. Consider case-insensitive parsing or a warning on unrecognized values.
• Error-level logging on anonymous input. Each bad or bogus callback logs at error. The verbose fields are gated behind OIDC_DEBUG, but a scanner still produces one error line per request. warn, or a simple rate limit, would be safer.
• Duplicated diagnostics. The base and debug diagnostic objects are built twice (authenticate callback and catch). A small buildOidcDiag(ctx, err, info?, status?, user?) helper would remove the drift risk.
• ?error= is ignored by the UI. As the PR itself notes, the login app only reads navigateUrl and token, so oidc_callback_failed and oidc_no_account currently show a plain login page. Fine as a marker, but a follow-up in LoginApp.svelte would help users.
• Retry loop. The design is reasonable (unbounded, no transient/permanent classification, gated warns, never-rejects contract). Two small additions:
  • The setTimeout sleep has no abort or shutdown hook, which matters for graceful shutdown and tests.
  • With a permanently wrong issuer URL, users get 503 indefinitely; the hourly warn is the only signal.
• registerOpenid called-once invariant. It is enforced only by a comment. A second call would create a second retry loop and duplicate routes.

[MichaelUray]

Thanks for the thorough review. The latest commits address the requested
changes.

1. Google now passes an email to handleProviderAuth only when Google has
   confirmed email_verified. GitHub retains the metadata from its emails API
   and passes an email only when it is both primary and verified; profiles
   without that fetched metadata are treated as unverified. The provider's
   social identifier remains unchanged.
2. OIDC callback coverage now exercises both a synchronous
   passport.authenticate() throw and a rejected middleware promise. Both are
   handled by the callback guard and redirect to
   /login?error=oidc_callback_failed.
3. handleProviderAuth catches its own failures and returns an empty string,
   so that outcome redirects to /login?error=oidc_no_account; the callback
   test reflects that production behavior.
4. The account-service shutdown path now aborts the OIDC registration retry
   loop through an AbortSignal, with coverage for that wiring.

The existing callback diagnostics and guarded logging remain in place. The
error query values are diagnostic markers; displaying a user-facing message in
the login UI remains a separate follow-up.

Verification:

• pods/authProviders: targeted Jest tests for OIDC and provider email
  verification
• pods/authProviders: formatter