feat(core): improve auth handling (#15271)

fix #15270
fix #15260
fix #15257


#### PR Dependency Tree


* **PR #15271** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

packages/backend/server/src/__tests__/oauth/controller.spec.ts

@@ -6,7 +6,12 @@ import ava, { TestFn } from 'ava';
 import Sinon from 'sinon';
 
 import { AppModule } from '../../app.module';
-import { ConfigFactory, InvalidOauthResponse, URLHelper } from '../../base';
+import {
+  ConfigFactory,
+  InvalidOauthResponse,
+  type SafeFetchOptions,
+  URLHelper,
+} from '../../base';
 import { SessionCache } from '../../base/cache';
 import { ConfigModule } from '../../base/config';
 import { CurrentUser } from '../../core/auth';
@@ -531,6 +536,7 @@ function createOidcRegistrationHarness(config?: {
   clientId?: string;
   clientSecret?: string;
   issuer?: string;
+  allowPrivateNetwork?: boolean;
 }) {
   const server = {
     enableFeature: Sinon.spy(),
@@ -551,6 +557,7 @@ function createOidcRegistrationHarness(config?: {
           clientId: config?.clientId ?? 'oidc-client-id',
           clientSecret: config?.clientSecret ?? 'oidc-client-secret',
           issuer: config?.issuer ?? 'https://issuer.affine.dev',
+          allowPrivateNetwork: config?.allowPrivateNetwork ?? false,
           args: {},
         },
       },
@@ -565,6 +572,12 @@ function createOidcRegistrationHarness(config?: {
     provider,
     factory,
     server,
+    fetchOptions: (url: string) =>
+      (
+        provider as unknown as {
+          fetchOptions(url: string): SafeFetchOptions;
+        }
+      ).fetchOptions(url),
   };
 }
 
@@ -940,7 +953,16 @@ test('oidc should not fall back to default email claim when custom claim is conf
 });
 
 test('oidc discovery should remove oauth feature on failure and restore it after backoff retry succeeds', async t => {
-  const { provider, factory, server } = createOidcRegistrationHarness();
+  const issuer = 'https://auth.internal/application/o/affine/';
+  const { fetchOptions: defaultFetchOptions } = createOidcRegistrationHarness({
+    issuer,
+  });
+  t.falsy(defaultFetchOptions(issuer).allowPrivateTargetOrigin);
+
+  const { provider, factory, server } = createOidcRegistrationHarness({
+    issuer,
+    allowPrivateNetwork: true,
+  });
   const fetchStub = Sinon.stub(provider as any, 'oidcFetch');
   const scheduledRetries: Array<() => void> = [];
   const retryDelays: number[] = [];
@@ -967,11 +989,11 @@ test('oidc discovery should remove oauth feature on failure and restore it after
     .resolves(
       new Response(
         JSON.stringify({
-          authorization_endpoint: 'https://issuer.affine.dev/auth',
-          token_endpoint: 'https://issuer.affine.dev/token',
-          userinfo_endpoint: 'https://issuer.affine.dev/userinfo',
-          issuer: 'https://issuer.affine.dev',
-          jwks_uri: 'https://issuer.affine.dev/jwks',
+          authorization_endpoint: `${issuer}authorize`,
+          token_endpoint: `${issuer}token`,
+          userinfo_endpoint: `${issuer}userinfo`,
+          issuer,
+          jwks_uri: `${issuer}jwks`,
         }),
         {
           status: 200,
@@ -986,6 +1008,11 @@ test('oidc discovery should remove oauth feature on failure and restore it after
   t.deepEqual(factory.providers, []);
   t.true(server.disableFeature.calledWith(ServerFeature.OAuth));
   t.is(fetchStub.callCount, 1);
+  t.is(
+    fetchStub.firstCall.args[0],
+    `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`
+  );
+  t.true(fetchStub.firstCall.args[2].allowPrivateTargetOrigin);
   t.deepEqual(retryDelays, [1000]);
 
   const firstRetry = scheduledRetries.shift();