[neilLasrado]

Slice 2 of 6 toward self-hosted Google login. Standalone: the handlers call authclient methods that already exist, so this builds and tests on its own.

Why

OSS registers proxy routes for GitHub SSO only:

h.GET("/webapi/github/login/web", ...)
h.GET("/webapi/github/callback", ...)
h.POST("/webapi/github/login/console", ...)

There is no /webapi/oidc/* anywhere in lib/. Those handlers live in the Enterprise tree.

This matters because both clients already point at those paths. getWebConfig lists OIDC connectors ungated and the React button component already renders them (picking a Google icon when the connector name contains "google"), and lib/client/sso.go:107 posts to /webapi/oidc/login/console. Without these handlers, a configured OIDC connector produces a login button that 404s.

Paths are fixed by api/client/webclient/webconfig.go:30 and lib/client/sso.go:107 — both verified against the source rather than assumed.

Change

• lib/web/oidc.go (new) — oidcLoginWeb, oidcLoginConsole, oidcCallback
• lib/web/apiserver.go — three route registrations, using the same middleware wrappers as the GitHub block (WithRedirect, WithMetaRedirect, WithLimiter)
• lib/web/oidc_test.go (new) — tests against a fake authclient.ClientI

The callback mirrors githubCallback rather than a simplified version: SSOSetWebSessionAndRedirectURL, the device-web-token redirect via BuildDeviceWebRedirectPath, the console certificate hand-off via ConstructSSHResponse/AuthParams, and the RedirectURLWithError fallback resolved through GetOIDCAuthRequest for a known non-web state token, falling back to LoginFailedBadCallbackRedirectURL.

One branch deliberately not carried across: errors.Is(err, auth.ErrGithubNoTeams). That sentinel is GitHub-team specific (lib/auth/github.go:53) with no OIDC analogue in the tree. If Slice 3 wants an equivalent "authenticated but unauthorised" signal — a wrong hosted domain, say — it will need its own sentinel error and a matching branch here.

Verification

Scoped to ./lib/web/ (GOFLAGS=-p=2 GOMAXPROCS=2, never ./...):

• go build ./lib/web/ — clean
• go test ./lib/web/ -run 'TestOIDC' -v — pass
• go test ./lib/web/ -run 'TestGithub|TestSSO|TestWebConfig|TestNewHandler|TestParseSSORequestParams' -v — pass

That second run is the meaningful one. TestGithubAuthCompat boots a full server via newWebPack, which panics on an httprouter path conflict. It didn't, so the new routes don't collide.

Note for Slice 3/4

authclient.OIDCAuthResponse.Req is authclient.OIDCAuthRequest — a hand-written JSON-friendly struct in clt.go:875, not the proto types.OIDCAuthRequest used by CreateOIDCAuthRequest. It carries only ConnectorID, CSRFToken, the public keys, CreateWebSession and ClientRedirectURL. This exactly parallels GithubAuthResponse.Req, so nothing needed changing — but it is not obvious from the type names and is worth knowing before anyone touches that response shape.

🤖 Generated with Claude Code