feat: first commit

backend/internal/adapter/identity/oidc.go

@@ -0,0 +1,74 @@
+// Package identity adapts OpenID Connect providers (Google, generic OIDC) to
+// the IdentityProvider port. Google is just an OIDC issuer, so one
+// implementation covers both required login methods.
+package identity
+
+import (
+	"context"
+	"errors"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+
+	"github.com/snip/backend/internal/port"
+)
+
+// GoogleIssuer is Google's OIDC discovery issuer.
+const GoogleIssuer = "https://accounts.google.com"
+
+type OIDCProvider struct {
+	name     string
+	oauth    *oauth2.Config
+	verifier *oidc.IDTokenVerifier
+}
+
+// NewOIDCProvider performs OIDC discovery against the issuer (one network call
+// at startup) and returns a ready provider.
+func NewOIDCProvider(ctx context.Context, name, issuer, clientID, clientSecret, redirectURL string, extraScopes []string) (*OIDCProvider, error) {
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		return nil, err
+	}
+	scopes := append([]string{oidc.ScopeOpenID, "email", "profile"}, extraScopes...)
+	return &OIDCProvider{
+		name: name,
+		oauth: &oauth2.Config{
+			ClientID:     clientID,
+			ClientSecret: clientSecret,
+			Endpoint:     provider.Endpoint(),
+			RedirectURL:  redirectURL,
+			Scopes:       scopes,
+		},
+		verifier: provider.Verifier(&oidc.Config{ClientID: clientID}),
+	}, nil
+}
+
+func (p *OIDCProvider) Name() string { return p.name }
+
+func (p *OIDCProvider) AuthURL(state string) string {
+	return p.oauth.AuthCodeURL(state, oauth2.AccessTypeOffline)
+}
+
+func (p *OIDCProvider) Exchange(ctx context.Context, code string) (*port.Identity, error) {
+	tok, err := p.oauth.Exchange(ctx, code)
+	if err != nil {
+		return nil, err
+	}
+	rawID, ok := tok.Extra("id_token").(string)
+	if !ok {
+		return nil, errors.New("oidc: response missing id_token")
+	}
+	idToken, err := p.verifier.Verify(ctx, rawID)
+	if err != nil {
+		return nil, err
+	}
+	var claims struct {
+		Sub   string `json:"sub"`
+		Email string `json:"email"`
+		Name  string `json:"name"`
+	}
+	if err := idToken.Claims(&claims); err != nil {
+		return nil, err
+	}
+	return &port.Identity{Subject: claims.Sub, Email: claims.Email, Name: claims.Name}, nil
+}