feat: do not show oidc consent screen every time

[steveiliop56]

Summary by CodeRabbit

• New Features

  • OIDC consent can now be remembered for previously approved scopes, reducing repeated authorization prompts.
  • Consent information is protected with signed cookies and secure-cookie settings.

• Bug Fixes

  • Authorization buttons now display loading feedback during automatic authorization.
  • Invalid OIDC client IDs and weak client secrets are rejected during setup with clear errors.
  • Missing OIDC clients now return a structured error instead of continuing authorization.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6174304f-a4e2-4fcd-84a1-630ee3510999

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

OIDC authorization now validates client configuration, signs approved scopes into a per-client cookie, verifies that cookie on later requests, and derives prompt=none when appropriate. Runtime cookie configuration and the authorization button loading state were updated accordingly.

OIDC scope consent flow

Layer / File(s)	Summary
Signed values and cookie contracts internal/service/oidc_service.go, internal/model/constants.go, internal/model/runtime.go, internal/bootstrap/app_bootstrap.go	Client IDs and secrets are validated, signed-value helpers are added, and scope-cookie configuration replaces the removed CSRF and redirect cookie fields.
Controller scope-cookie flow internal/controller/oidc_controller.go	Authorization verifies approved scopes, client lookup errors return JSON, and consent completion writes a signed scope cookie using configured cookie security.
Authorize button state frontend/src/pages/authorize-page.tsx	The authorize button uses loading state for both mutation activity and auto-authorization mode.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant OIDCController
  participant OIDCService
  participant OIDCClient
  Browser->>OIDCController: Send authorize request
  OIDCController->>OIDCService: Verify approved scope cookie
  OIDCService-->>OIDCController: Return verification result
  OIDCController->>OIDCClient: Get client configuration
  OIDCClient-->>OIDCController: Return client
  OIDCController-->>Browser: Return consent response and signed scope cookie

Loading

Possibly related PRs

• tinyauthapp/tinyauth#605: Introduces the OIDC authorization flow extended by these scope-cookie changes.
• tinyauthapp/tinyauth#923: Refactors the OIDC controller flow modified here.
• tinyauthapp/tinyauth#948: Adds related OIDC prompt handling, including prompt=none.

Suggested labels: lgtm

Suggested reviewers: scottmckendry

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: reducing repeated OIDC consent prompts.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oidc-consent-screen

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

internal/service/oidc_service.go (1)

310-328: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

OIDC startup now rejects legacy client configs internal/service/oidc_service.go:310-328
NewOIDCService now hard-fails on any client that doesn't use a UUID clientId and a 32+ char secret. The repo still has OIDC fixtures using some-client-id / some-client-secret, so add a migration path or keep accepting legacy values with a warning.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/oidc_service.go` around lines 310 - 328, Update
NewOIDCService’s client validation to preserve backward compatibility with
legacy client IDs and secrets used by existing fixtures. Replace the
unconditional UUID and 32-character secret failures around uuid.Validate and the
client-secret length check with a migration or compatibility path that accepts
legacy values while emitting clear warnings, while retaining strict validation
for newly configured clients where appropriate.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/controller/oidc_controller.go`:
- Around line 247-259: Bind the consent cookie to the authenticated user in the
OIDC prompt handling around VerifySignedValue: include the current user's stable
identity, such as the `sub` claim, in the signed payload and validate that same
identity before skipping consent. Update the consent-cookie creation logic to
sign the identical user-bound value, and clear or invalidate the cookie during
logout so it cannot survive account changes.

In `@internal/service/oidc_service.go`:
- Around line 995-997: Replace the regular string comparison in
OIDCService.VerifySignedValue with hmac.Equal, comparing the generated signature
and signedValue as byte slices to ensure constant-time verification.

---

Outside diff comments:
In `@internal/service/oidc_service.go`:
- Around line 310-328: Update NewOIDCService’s client validation to preserve
backward compatibility with legacy client IDs and secrets used by existing
fixtures. Replace the unconditional UUID and 32-character secret failures around
uuid.Validate and the client-secret length check with a migration or
compatibility path that accepts legacy values while emitting clear warnings,
while retaining strict validation for newly configured clients where
appropriate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 90bd38a8-adfa-4101-b24a-c7a3dd3a322e

📥 Commits

Reviewing files that changed from the base of the PR and between 405d910 and ff271e7.

📒 Files selected for processing (6)

• frontend/src/pages/authorize-page.tsx
• internal/bootstrap/app_bootstrap.go
• internal/controller/oidc_controller.go
• internal/model/constants.go
• internal/model/runtime.go
• internal/service/oidc_service.go