Multi-IDP support

[dgellow]

Summary

• Replace Google-specific OAuth with a provider abstraction supporting Google, Azure AD, GitHub, and generic OIDC
• Separate authentication (identity fetching) from authorization (access policy) so IDP errors and policy rejections produce distinct error types
• Systematic quality pass: fix bugs, unify patterns, reduce complexity

Breaking change

Config format changes from flat googleClientId/googleClientSecret fields to a structured idp block:

"idp": {
  "provider": "google|azure|github|oidc",
  "clientId": "...",
  "clientSecret": {"$env": "..."},
  "redirectUri": "..."
}

Quality improvements

• Fix duplicate isStdioServer with diverging implementations
• Unify CSRF tokens to stateless HMAC approach (removes sync.Map leak)
• Make StoreAuthorizeRequest return error (Firestore failures were silent)
• Fix SameSite cookie mismatch (Strict → Lax for OAuth callbacks)
• Add GetUser to Storage interface for O(1) admin checks
• Split oversized files, consolidate tiny packages, delete dead code

Closes #31, closes #29

[gemini-code-assist]

Summary of Changes

Hello @dgellow, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly refactors the authentication system by introducing a robust Identity Provider (IDP) abstraction. This change moves away from a hardcoded Google OAuth implementation to a flexible, pluggable model that can integrate with various IDPs like Google, Azure AD, GitHub, and any OIDC-compliant service. The update involves substantial changes to configuration, validation, and core authentication handlers to support this new multi-IDP architecture, enhancing the system's extensibility and security.

Highlights

• Multi-IDP Support: The system now supports multiple Identity Providers (IDPs) including Google, Azure AD, GitHub, and generic OIDC providers, replacing the previous Google-specific OAuth implementation.
• Provider Abstraction Layer: A new internal/idp package has been introduced, defining a Provider interface and concrete implementations for each supported IDP, centralizing authentication logic.
• Configuration Changes: The OAuth configuration format has been updated to include a nested idp block, which encapsulates provider-specific settings like provider type, clientId, clientSecret, and redirectUri.
• Enhanced Validation: Validation logic has been extended to enforce required fields for the new idp configuration and to include provider-specific requirements, such as tenantId for Azure AD and allowedOrgs for GitHub.
• Session Cookie Update: The SessionCookie struct now includes a Provider field to track which Identity Provider authenticated the user, enabling multi-IDP session management.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request is an excellent refactoring effort that replaces a Google-specific OAuth implementation with a flexible, provider-based abstraction. The introduction of the internal/idp package with a Provider interface is well-executed and allows for easy extension to other identity providers. The configuration changes, while breaking, are clearly documented and the new structure is more logical. The validation logic has been updated to be provider-aware, which is a great improvement. I've identified a couple of areas for improvement, mainly around code duplication in the configuration parsing and test coverage for the new GitHub provider. Overall, this is a high-quality change that significantly improves the authentication capabilities of the application.

[dgellow]

/gemini review

[gemini-code-assist]

Code Review

This is an excellent pull request that significantly improves the authentication architecture by introducing a well-designed abstraction for multiple identity providers. The separation of authentication (identity fetching) from authorization (access policy) is a great design choice that enhances clarity and flexibility. The codebase quality pass has resulted in numerous improvements, such as fixing the stateful CSRF implementation, improving database lookups for admin checks, and general code cleanup by splitting oversized files and consolidating small packages. The changes are consistently applied across the configuration, implementation, tests, and documentation. I have one minor suggestion to improve the clarity of a validation error message.

[gemini-code-assist]

The suggested command openssl rand -base64 32 generates a 44-character string, which might be confusing given the 32-character minimum requirement. To avoid this confusion and provide a command that generates a key closer to the minimum length, you could suggest openssl rand -base64 24 which produces exactly 32 characters.

Suggested change

	if len(oauth.JWTSecret) < 32 {
	return fmt.Errorf("jwtSecret must be at least 32 characters (got %d). Generate with: openssl rand -base64 32", len(oauth.JWTSecret))
	}
	if len(oauth.JWTSecret) < 32 {
	return fmt.Errorf("jwtSecret must be at least 32 characters (got %d). Generate with: openssl rand -base64 24", len(oauth.JWTSecret))
	}