http: GET /auth/oidc/login — generate state/PKCE, redirect to IdP

2026-05-05 13:26:06 +01:00
parent ede014e85b
commit 746324e65a
3 changed files with 129 additions and 0 deletions
@@ -0,0 +1,35 @@
+// oidc_handlers.go — OIDC sign-in handlers. Public routes when oidc
+// is configured (s.deps.OIDC != nil), otherwise not mounted.
+package http
+
+import (
+	"log/slog"
+	stdhttp "net/http"
+	"time"
+
+	"gitea.dcglab.co.uk/steve/restic-manager/internal/server/oidc"
+)
+
+// handleOIDCLogin generates state + PKCE pair, persists them, and
+// redirects to the IdP authorization endpoint.
+func (s *Server) handleOIDCLogin(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+	state, err := oidc.RandomState()
+	if err != nil {
+		slog.Error("oidc login: state", "err", err)
+		stdhttp.Error(w, "internal", stdhttp.StatusInternalServerError)
+		return
+	}
+	verifier, challenge, err := oidc.PKCEPair()
+	if err != nil {
+		slog.Error("oidc login: pkce", "err", err)
+		stdhttp.Error(w, "internal", stdhttp.StatusInternalServerError)
+		return
+	}
+	if err := s.deps.Store.PutOIDCState(r.Context(),
+		oidc.HashState(state), verifier, time.Now().UTC()); err != nil {
+		slog.Error("oidc login: persist state", "err", err)
+		stdhttp.Error(w, "internal", stdhttp.StatusInternalServerError)
+		return
+	}
+	stdhttp.Redirect(w, r, s.deps.OIDC.AuthURL(state, challenge), stdhttp.StatusSeeOther)
+}