[PiquelChips]

Nothing outside our own tests checked auth against the OpenID specifications. Now just conformance runs the OpenID Foundation's conformance suite against auth, and CI runs it on every change to auth's OAuth and OIDC code, on main and nightly.

• One recipe, any target. just conformance builds auth and runs it with its own PostgreSQL and Mailpit behind Caddy's HTTPS; just conformance <url> runs against a preview, through its CLI. The suite runs from its prebuilt image, pinned to release-v5.3.4.
• Passkey sign-in. The suite's browser can't do WebAuthn, so tests/conformance/driver.ts plays it in Chromium with a virtual passkey: it signs an account up, signs in, consents, confirms logout and uploads the screenshots REVIEW tests ask for. Results, screenshots and logs land in target/conformance, which CI uploads.
• expected.json only shrinks. Every result must equal its entry, or be PASSED without one; an unexpected PASSED fails too. Each of the 44 entries links the issue that fixes it.
• All four plans run, back-channel logout included. Caddy replaces the suite's nginx so auth can trust the suite's certificate, and a new test-only AUTH_LOOPBACK_LOGOUT_CA lets back-channel logout tokens reach it on localhost. A preview can't reach the suite on your machine, so it skips that plan.

What the run finds on main

Most of the Basic and logout plans fail at their first authorization: auth requires PKCE from every client and the suite sends none. That's #514, fixed by #521. With PKCE optional for confidential clients, what remains is:

• feat(auth): obtain OpenID certification #52: no client_secret_post yet; and the warnings and screenshot reviews certification accepts, such as profile claims auth doesn't hold.
• New: fix(auth): UserInfo accepts the access token in a form body #515 (UserInfo token in a form body), fix(auth): a replayed code also ends the access token issued from it #516 (access tokens after a code replay), feat(auth): the claims request parameter #517 (the claims parameter).

The auth fixes (#521, #522, #523) no longer wait on this PR. Whichever merges second updates expected.json.

Closes #51

Note

Written by Claude Opus 5.5 in Claude Code (via T3 Code)

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn