quality(coverage): measure OIDC verification core

[seonghobae]

Purpose

Advance issue #84 from current protected main with a bounded OIDC verification coverage/security slice. This PR keeps the OIDC JWT verification core inside owned-production coverage and closes realistic upstream-document and claim-validation branches without restoring broad V8 exclusions or weakening the 100% coverage gate.

Current exact state

• branch: quality/oidc-core-coverage-slice
• protected/live base: 56fde1865bd8e1ab4798d1650632ba71ba9f5b1c
• exact current head: 378e8fc76e18d7beb635e75bd97a417247d146f2
• Draft remains intentional.
• predecessor-head checks/reviews do not transfer.
• current formal reviews: none at the latest pre-write refetch.

Coverage and reliability work

The slice removes only the broad V8 exclusion around base64UrlDecode, base64UrlEncode, decodeJson, fetchGithubOidcKeys, and verifyGithubOidcJwt. Executable public /exchange regressions now cover or harden:

• malformed/non-success OIDC discovery and JWKS responses;
• non-string, empty, and off-origin jwks_uri values;
• malformed/null/non-array JWKS documents;
• discovery/JWKS transport rejection and expired JWKS cache refetch;
• audience-array and workflow_ref fallback handling;
• missing kid, missing signing keys with forced refresh, invalid signatures, future nbf, missing exp, missing workflow ref, malformed payload JSON, workflow-repository mismatch, and unexpected verifier failure.

Test-first JWKS entry-shape repair

Exact head ecfaecad75dc14794151a7866ccd0143449c59ba still failed application release verify after the residual-branch regressions, while reviewer-ci and Security Scan succeeded. During the next RCA pass, source inspection exposed a separate Noema-owned reliability/security classification defect: fetchGithubOidcKeys accepted any array as keys, so a malformed upstream document such as { "keys": [null] } reached key.kid, raised TypeError, and was misclassified by the JWT catch boundary as client ERR_TOKEN_MALFORMED instead of an upstream OIDC document failure.

• RED: b77ee98b8180e077df2d36626eb19de80187c1b4 adds a public-path regression requiring malformed JWKS key entries to fail closed as HTTP 502 / ERR_OIDC_VERIFICATION before key selection.
• GREEN: 378e8fc76e18d7beb635e75bd97a417247d146f2 validates every JWKS key entry as a plain JSON object before caching/selection and preserves the existing valid-key path. The GREEN commit changes only three production lines in src/index.ts relative to the RED head.

No source behavior outside this upstream schema boundary, coverage threshold, or central security gate was weakened.

Evidence boundary

Fresh exact-head workflows for 378e8fc76e18d7beb635e75bd97a417247d146f2 were queued at the first post-write refetch:

• application CI 31993727469: queued;
• reviewer-ci 31993727486: queued;
• central Security Scan 31993727453: queued.

Queued/pending evidence is non-passing. Keep Draft and do not merge until the unchanged exact head has terminal-success application CI plus every applicable live central Security/review/governance gate and zero valid unresolved findings. If application CI still fails, identify the new exact first failing boundary before another repair; do not restore broad coverage exclusions or weaken thresholds.

Related: #84.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0df28f85-ed71-4a78-ae7e-3c2c0d908e82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}