Implementation update — Telegram OIDC BFF and YDB Web sessions

Implementation is ready in MR !22, branch ai/web-02-oidc-bff, commit 0608460.

Implemented

• A Go same-origin Web BFF with health/version endpoints, Telegram login start/callback, logout, current identity, membership list, and active-tenant rotation.
• Telegram OIDC Authorization Code + PKCE S256, browser-bound one-time state, nonce, exact redirect URI, server-side Basic-auth token exchange, exact production endpoint pinning, RS256-only JWT verification, and bounded JWKS caching/refresh.
• Secure first-party __Host- cookies, exact-Origin plus session-bound CSRF validation, 12-hour sliding idle lifetime, seven-day absolute lifetime, revocation, and mandatory session/CSRF rotation when changing tenants.
• A deterministic Go-only Telegram-shaped OIDC fixture that generates an ephemeral RSA key and refuses every environment except exact local.
• Seven YDB migrations for immutable external identities, reverse identity lookup, tenant memberships, invitations, OIDC login challenges, Web sessions, and the audited development-bootstrap ledger.
• Automatic YDB size/load partitioning on the new tables. Stable hashed leading buckets distribute pre-authentication and session point lookups; they do not impose a physical partition count.
• Telegram ingestion now atomically materializes the same external identity and owner membership used by Web login. Telegram proves the external identity; active Sessionless membership remains the authorization source.
• An operator-only make web-bootstrap command that requires exact cloud-dev, an existing external identity, operator/reason metadata, stdin typed confirmation, metadata/environment YDB credentials, idempotent exact grants, and a redacted audit event.
• Updated README, development, Web-auth/threat-model, YDB state-store, and partitioning documentation. Public text is English-only.

Verification

Local:

• make ci passed: generate, vet, race tests, all 13 binaries, and foundation integration tests.
• The full login/switch/logout flow passed 50 consecutive race-enabled runs.
• Wrong PKCE, untrusted signing key, endpoint override, code replay, unknown membership, CSRF, old-session replay, and authentication-material log-redaction negatives passed.
• git diff --check and public Cyrillic scan passed.

Mirrored GitHub Actions run #65 is green for the exact commit 0608460:

• Go verification — success;
• YDB schema and state store — success, including applying all 55 migrations twice and running concurrent challenge/bootstrap/identity/session isolation tests;
• Local multi-service stand — success, including stop/restart persistence;
• Terraform environments — success;
• Runtime images — success, including the distroless Go Web BFF image.

During verification, a probabilistic login defect was found and fixed: unprefixed base64url secrets could begin with _ or -, violating the opaque-ID contract and randomly rejecting a callback. Typed alphabetic prefixes now make the invariant deterministic; the 50-run regression is green.

Issue #31 remains open until MR !22 is merged.

Completion report — merged

WEB-02 was merged through MR !22 into main as commit 2aa2c7f.

The requested review fixes are included:

• the documented routes now match the executable /auth/logout and /api/web/v1/... contract;
• web-bff listens on the documented WEB_PORT with a non-conflicting 8083 default;
• login failures and CSRF rejections are synchronously persisted as redacted YDB security-audit events, including pre-authentication failures without a resolved tenant.

The mirrored branch run passed Go/race verification, Terraform validation, repeatable YDB migrations and integration tests, the local multi-service stand, and runtime image builds: GitHub Actions run #66.

Issue closure was performed automatically by the merged MR.

Merged-main verification is complete: GitHub Actions CI run #67 passed for main commit 2aa2c7f (Go verification, YDB schema/state store, local multi-service stand, Terraform validation, and runtime images). WEB-02 remains closed.

Обработал оба замечания в cd3a4c2.

P1 (comment 185229856): SnapshotBuilder теперь вызывает event.Validate и сверяет tenant/session с запросом до sequence check и blobs.Open. Regression TestSnapshotBuilderRejectsCrossSessionEventBeforeOpeningPayload проверяет, что same-tenant event другой session отклонён до чтения payload.

P2 (comment 185229860): snapshot creation подключён к production reconciler после успешных publish и outbox acknowledge. Политика явная и bounded: SNAPSHOT_INTERVAL_EVENTS=128, SNAPSHOT_MAX_VERSIONS=32, build ограничен LIMIT_CONTEXT_EVENTS/BYTES. Ошибка maintenance наблюдается и логируется, но не ломает dispatch; canonical replay остаётся correctness path. Добавлены local/cloud S3 wiring и storage.editor для scheduler service account.

Проверки: make test; make ydb-integration; make compose-config; make e2e-local; make ci; make terraform-ci.