internal/controller/oidc_controller.go (1)

280-290: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing json: true for consistent JSON error response.

The authorizeComplete handler is designed to return JSON responses for frontend consumption (as noted in the comment on line 212-214). However, the error case at lines 280-290 doesn't set json: true, which would cause a 302 redirect instead of a JSON response, inconsistent with all other error paths in this handler.

Proposed fix

 	err = controller.oidc.DeleteOldSession(c, sub)
 	if err != nil {
 		controller.authorizeError(c, authorizeErrorParams{
 			err:           err,
 			reason:        "Failed to delete old sessions",
 			reasonPublic:  "Failed to delete old sessions",
 			callback:      authorizeReq.RedirectURI,
 			callbackError: "server_error",
 			state:         authorizeReq.State,
+			json:          true,
 		})
 		return
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/controller/oidc_controller.go` around lines 280 - 290, The error
path calls controller.authorizeError with an authorizeErrorParams struct but
omits the json flag, causing a redirect instead of the intended JSON response;
update the authorizeError invocation in the authorizeComplete handler (the block
that constructs authorizeErrorParams using err, reason "Failed to delete old
sessions", callback: authorizeReq.RedirectURI, callbackError: "server_error",
state: authorizeReq.State) to include json: true so the authorizeError function
returns a consistent JSON error response.

internal/controller/oidc_controller.go (2)

122-141: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Handle request objects from POST form bodies too.

With the new POST support, this branch only checks request in the URL query. If a client sends request=<jwt> in the form body, the code falls through to binding.Form, but service.AuthorizeRequest has no request field, so the JWT is dropped and validation runs against an empty request. That breaks POST request-object flows.

Suggested fix

-	// step 1: if we have a request object, decode it and ignore other params. If not, bind the params as usual
-	if raw := reqQueries.Get("request"); raw != "" {
+	// step 1: if we have a request object, decode it and ignore other params. If not, bind the params as usual
+	raw := reqQueries.Get("request")
+	if raw == "" && c.Request.Method == http.MethodPost {
+		raw = c.PostForm("request")
+	}
+	if raw != "" {
 		requestObject, err := controller.oidc.DecodeAuthorizeJWT(raw)
 		if err != nil {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/controller/oidc_controller.go` around lines 122 - 141, The code only
checks reqQueries.Get("request") (query string) and thus ignores a "request" JWT
sent in a POST form body; update the branch that handles request objects so it
also looks for the "request" parameter in POST form data before falling back to
binding. Specifically, inside the authorize handler around
reqQueries/Get("request") and before calling DecodeAuthorizeJWT, check for a
form "request" value when c.Request.Method == http.MethodPost (e.g., use
c.PostForm("request") or ensure c.Request.ParseForm() and inspect
c.Request.Form/PostForm), then call controller.oidc.DecodeAuthorizeJWT(raw) and
handle errors via controller.authorizeError with authorizeErrorParams as
currently done; if decoded, assign to req (the same variable used with
c.ShouldBindWith) and skip the binding. This keeps existing logic in
DecodeAuthorizeJWT, authorizeError, c.ShouldBindWith, binding.Form intact while
supporting POST request-object flows.

---

280-287: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep /oidc/authorize-complete errors on the JSON contract.

This handler is frontend-facing and already returns JSON on success and on its earlier failures, but these two branches drop back to redirect mode because json: true is missing. A backend error here will produce a 302 to the client callback instead of the {status, redirect_uri} payload the caller expects.

Suggested fix

 	err = controller.oidc.DeleteOldSession(c, sub)
 	if err != nil {
 		controller.authorizeError(c, authorizeErrorParams{
 			err:           err,
 			reason:        "Failed to delete old sessions",
 			reasonPublic:  "Failed to delete old sessions",
 			callback:      authorizeReq.RedirectURI,
 			callbackError: "server_error",
 			state:         authorizeReq.State,
+			json:          true,
 		})
 		return
 	}
@@
 	if err != nil {
 		controller.authorizeError(c, authorizeErrorParams{
 			err:           err,
 			reason:        "Failed to build query",
 			reasonPublic:  "Failed to build query",
 			callback:      authorizeReq.RedirectURI,
 			callbackError: "server_error",
 			state:         authorizeReq.State,
+			json:          true,
 		})
 		return
 	}

Also applies to: 300-307

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/controller/oidc_controller.go` around lines 280 - 287, The authorize
error branches in the authorize-complete handler call controller.authorizeError
without json=true, causing redirects instead of the expected JSON {status,
redirect_uri} contract; update both calls that construct authorizeErrorParams
(the one passing reason "Failed to delete old sessions" and the later similar
branch around the authorizeError invocation at the 300-307 range) to include
json: true so controller.authorizeError returns a JSON response; locate the
calls to controller.authorizeError and add json: true to the
authorizeErrorParams passed to it.