security: complete the 2.4.0 pre-release audit (AUDIT-06 to AUDIT-22)

[lakhansamani]

Pre-release security audit remediation, part 2 of 2. Stacked on #748 (merged).
Closes the remaining findings: AUDIT-06 through AUDIT-22.

With this, all 22 findings are resolved.

Findings closed

#	Sev	Finding
AUDIT-06	Medium	OAuth state not bound to the initiating browser (login CSRF)
AUDIT-07	Medium	Authorization code not bound to client_id (RFC 6749 §4.1.3)
AUDIT-08	Medium	Agent FGA attenuation silently failed open
AUDIT-09	Medium	at_hash/c_hash hard-coded to SHA-256 regardless of alg
AUDIT-10	Medium	Access/refresh tokens stored in plaintext in the session store
AUDIT-12	Medium	Signup response enabled account enumeration
AUDIT-15	Medium	CORS reflected an arbitrary Origin with Allow-Credentials
AUDIT-17	Low	Password change revoked sessions fire-and-forget
AUDIT-18	Low	public gRPC methods bypass delegated-scope enforcement
AUDIT-19	Low	"Encrypt"-named helpers were plain base64
AUDIT-20	Low	HMAC symmetric key marshaled into a JWK
AUDIT-21	Low	bcrypt cost 10

AUDIT-13 (session-cookie SameSite/domain) was reviewed and declined — see below.
AUDIT-16 and AUDIT-22 needed no change: the --url startup warning already cites
GHSA-m82j-rq33-qjx2, and govulncheck already runs on PRs and weekly.

Highlights

AUDIT-06. state was server-generated and stored globally, so the callback could
only prove some flow issued it, never that this browser did. An attacker harvests
their own valid code+state and delivers it to a victim, logging the victim into the
attacker's account; anything the victim then enters lands somewhere the attacker
controls. A host-only HttpOnly cookie now binds the flow to the browser that started it.

SameSite is None when Secure, matching the MFA cookie — Apple returns its callback as
a cross-site form_post, and a Lax cookie is not sent on one. The cookie is read back
url-unescaped because gin escapes on write and nothing reverses it on read.

AUDIT-07. Codes were bound to a redirect_uri but not to an identity, so two
confidential clients sharing a redirect origin could redeem each other's codes. The token
endpoint now compares against the authenticated client, not the raw body field —
clients may authenticate via Basic or a client assertion and send no body client_id at
all.

Both findings needed a new field in a positional @@-delimited blob that was hand-built
and hand-parsed at ~12 sites across http_handlers and service. internal/codestate
now owns both formats; decoding is length-guarded per field, so codes minted by an older
build stay redeemable across a deploy.

AUDIT-08. A delegated (agent-acting-for-user) FGA check against a model with no
type agent authorized as the delegating user alone — silently dropping the agent half
of perms(agent) ∩ perms(user), which is the Confused Deputy the intersection exists to
prevent. A check that cannot be evaluated is not a check that passes. It denies now;
--fga-allow-unconstrained-agents restores the old behaviour for operators mid-migration,
logged on every use and still metered.

AUDIT-10. Tokens were stored verbatim, so anyone who could read the store — a Redis
dump, a replica, a backup, an SSRF into the cache — walked away with live, directly
replayable tokens. Stored as SHA-256 digests now, with dual-read on the way out so no
live session or refresh token drops on deploy. Three comparison sites moved with it, one
of which (revoke.go) was a plain != against a live refresh token rather than a
constant-time compare.

AUDIT-12. Timing was already equalised; the response shape was not — a distinct error
for a taken address versus "check your inbox" for a free one is an account-existence
oracle. Both paths now return one shared constant. Only closable when verification is on:
with it off a real signup answers with tokens, so a collision differs by shape whatever
the message says.

Also fixed: a user-reported bug (not from the audit)

A user who clicked their verification link was told permanently that their email was
not verified, most visibly by passkey login. The email_verified_at write sat after the
MFA gate, and all three gate branches return early — and MFA is on by default, so a fresh
signup's verification click lands on the setup screen and the write never happened. The
user had done everything right; the proof of mailbox control was discarded because MFA
interrupted session issuance.

Recorded as soon as the token is proven now. Also affected magic-link and invite flows
through the same function.

AUDIT-13: reviewed and declined

The audit wanted SameSite=Lax + host-only session cookies. Both were kept:

• the domain-scoped (.example.com) twin is what lets app.example.com see a session
  established at auth.example.com — dropping it breaks subdomain SSO outright;
• SameSite=None is what lets an app on a different site complete a credentialed
  /session call at all.

Auth0 lands in the same place: it recommends SameSite=None for cross-origin
authentication, ships fallback cookies for browsers that cannot do it, and answers
third-party-cookie blocking with Custom Domains — auth server on the customer's own
subdomain, which is exactly this topology.

The reasoning is now recorded at cookie.BuildSessionCookies with guard tests in
internal/cookie and cmd, so it fails loudly rather than being silently "fixed" later.

Review follow-up: the strict SameSite path

Raised in review, and both halves were real.

--app-cookie-same-site was never validated. cookie.ParseSameSite falls
back to Lax for anything it does not recognise — safe, but silent. An operator
who asks for strict and mistypes it gets Lax: a genuine downgrade from
what they requested, with nothing anywhere to say so. A mistyped none goes the
other way and withholds the session cookie from cross-site apps, presenting as
"login randomly doesn't stick" with the cause three layers away. Now validated
at startup next to ValidateEncryptionKey. Verified live — an invalid value
exits 1 with the reason, strict boots through to "Starting HTTP server".

One place deliberately ignores the setting, and nothing said so.
BuildOAuthStateCookie (new in AUDIT-06) hardcodes Lax/None. That is a
correctness requirement, not a preference: the provider's callback arrives as a
cross-site redirect — a cross-site form_post for Apple — and Strict withholds
the cookie on exactly those, so every social login on a strict-configured
deployment would fail with "invalid oauth state". Threading the operator's
setting through "for consistency" is the obvious refactor and a silent outage.
Documented, and TestOAuthStateCookieIsNeverStrict now fails if anyone tries.

Build tooling: make test-all-db and every per-DB target

Not in the audit, but these produce red builds that have nothing to do with the
code under test, and two of them bit this branch directly.

• Teardown did not survive failure. docker rm -vf sat on its own recipe
  line, so a failing test aborted the recipe before cleanup, leaving ports bound
  and breaking the next run for a second, unrelated reason. One real bug
  became two confusing ones.
• Readiness was a guess. sleep 3/sleep 5/sleep 15 instead of a check.
  ScyllaDB routinely needs 30-60s before accepting CQL, so on a cold or loaded
  machine the storage tests ran against a still-booting database.
• test-all-db had a prerequisite that never ran. It listed
  test-cleanup test-docker-up test-cleanup; the trailing duplicate read as
  "tear down afterwards" but make deduplicates prerequisites, so it silently
  collapsed into the leading one.

All seven targets now wait on a bounded per-port poll (scripts/wait-for-test-dbs.sh,
which fails the run outright if a container never comes up) and always tear down,
exiting with the tests' status.

Testing

New: internal/codestate (format + legacy-blob decoding), at_hash per-alg digests, CORS
header matrix, cross-client code redemption, FGA fail-closed + opt-out + nil-config,
signup enumeration, and a signup × email-verification matrix (15 cells) that pins the
invariant the passkey bug slipped through — each flow was tested in isolation, the
invariant across them was not.

Fail-before/pass-after was confirmed by reverting each fix individually. Notably, the
nOAuth vulnerability was reproduced live against a stale image during e2e (callback
returned 302 + a session for an unattested address; 400 email_not_verified after).

Also restores one-provider-per-spec-file in the social e2e: mock-oauth holds one profile
per provider globally, so two spec files driving the same provider race under parallel
workers.

Principal-class matrix. The identity invariant is different per principal class, and
treating them as one is what let the social path drift into resolving accounts by email
while the SSO path (correctly) never did:

Class	Identity is…
Database	the email, proven by clicking a mailed link
Social / OAuth / OIDC	the email — so the provider must attest it
SSO / SAML	(org, issuer, subject); email never selects an account
M2M	the service account — no user, no email
A2A	sub stays the user; the agent rides in act

Each row now has tests. SSO/SAML: email never links whether attested or not, the subject
survives an upstream email change, and the same subject under a different org is a
different principal. M2M: no email/email_verified/roles claims ride along — those
would let user-scoped gates evaluate against a zero value, and "is this verified?" checks
tend to fail open on zero. A2A: sub=agent would silently drop every user-scoped gate,
and a missing act loses the agent half of the FGA intersection.

Verified

make lint (0 issues), go build, go vet, 42 Go packages, 86/86 Playwright at default
parallelism, and make test-all-db across all seven backends — each with its real exit
code checked, not a pipeline's.

Breaking changes

• --enable-email-verification with no SMTP now fails at boot. Every recovery route
  terminates at the same mailbox, so without a mail path a user is created unverified and
  can never recover.
• Delegated FGA against a model with no type agent is now denied. Add type agent,
  or set --fga-allow-unconstrained-agents while migrating.
• Wildcard CORS no longer sends Allow-Credentials and returns a literal * rather
  than the caller's Origin. Credentialed CORS requires an explicit allow-list.
• bcrypt cost 12 for new hashes. Write-side only — the cost lives inside each hash
  string, so existing cost-10 hashes keep verifying and nobody is locked out.
• crypto.EncryptB64/DecryptB64 removed (callers moved to EncodeB64/DecodeB64);
  NewHMACKey no longer returns a JWK.