test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_auth_flow_test.go

@@ -88,3 +88,99 @@ func TestAuthCallback_ExchangeFailureInvalidatesState(t *testing.T) {
 		t.Errorf("expected code_verifier cleared after failed exchange, got %q", got)
 	}
 }
+
+// TestAuthCallback_PostExchangeFailureClearsOneTimeState guards the fix for the
+// post-exchange (code-consuming) failure branches: after a successful
+// authorization-code exchange followed by a failed id-token verification, the
+// one-time CSRF/nonce/code_verifier state must be cleared and persisted, just
+// like the exchange-failure path. Otherwise the session stays in a stale
+// pending-auth state and a retried callback re-exchanges a fresh code before
+// failing again (R134).
+func TestAuthCallback_PostExchangeFailureClearsOneTimeState(t *testing.T) {
+	testLogger := newNoOpLogger()
+
+	sessionManager, err := NewSessionManager(
+		"test-encryption-key-32-bytes-long!!",
+		false,
+		"",
+		"",
+		0,
+		testLogger,
+	)
+	if err != nil {
+		t.Fatalf("NewSessionManager: %v", err)
+	}
+	defer sessionManager.Shutdown()
+
+	oidc := &TraefikOidc{
+		sessionManager: sessionManager,
+		logger:         testLogger,
+		enablePKCE:     true,
+		// Exchange succeeds (consumes the code) but subsequent id-token
+		// verification fails, so we land in a post-exchange failure branch.
+		tokenExchanger: &EnhancedMockTokenExchanger{
+			ExchangeResponse: &TokenResponse{AccessToken: "access-token", IDToken: "id-token"},
+		},
+		tokenVerifier: &EnhancedMockTokenVerifier{Err: errors.New("verification failed")},
+	}
+
+	csrfToken := "valid-csrf-token"
+	req := httptest.NewRequest(http.MethodGet, "/callback?code=auth-code&state="+csrfToken, nil)
+	rw := httptest.NewRecorder()
+
+	session, err := sessionManager.GetSession(req)
+	if err != nil {
+		t.Fatalf("GetSession: %v", err)
+	}
+	session.SetCSRF(csrfToken)
+	session.SetNonce("test-nonce")
+	session.SetCodeVerifier("test-code-verifier")
+	if err := session.Save(req, rw); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	session.returnToPoolSafely()
+
+	// Drive the callback with the session cookies from the first save.
+	req2 := httptest.NewRequest(http.MethodGet, "/callback?code=auth-code&state="+csrfToken, nil)
+	for _, c := range rw.Result().Cookies() {
+		req2.AddCookie(c)
+	}
+	rw2 := httptest.NewRecorder()
+	oidc.handleCallback(rw2, req2, "https://example.com/callback")
+
+	if rw2.Code != http.StatusInternalServerError {
+		t.Fatalf("expected 500 on id-token verify failure, got %d", rw2.Code)
+	}
+
+	// The post-exchange failure must persist the cleared one-time state,
+	// which means the callback response must carry a session cookie. On the
+	// pre-fix code the branch returned without saving, so there is no
+	// cookie and this is the fail-on-old discriminator.
+	respCookies := rw2.Result().Cookies()
+	if len(respCookies) == 0 {
+		t.Fatal("expected callback to persist the cleared session cookie after post-exchange failure")
+	}
+
+	// Reload the session from the callback's own cookie (which, on the old
+	// code, was never written): the code was consumed, so the one-time
+	// auth state must have been cleared there.
+	req3 := httptest.NewRequest(http.MethodGet, "/callback", nil)
+	for _, c := range respCookies {
+		req3.AddCookie(c)
+	}
+	session3, err := sessionManager.GetSession(req3)
+	if err != nil {
+		t.Fatalf("GetSession after callback: %v", err)
+	}
+	defer session3.returnToPoolSafely()
+
+	if got := session3.GetCSRF(); got != "" {
+		t.Errorf("expected CSRF cleared after post-exchange verify failure, got %q", got)
+	}
+	if got := session3.GetNonce(); got != "" {
+		t.Errorf("expected nonce cleared after post-exchange verify failure, got %q", got)
+	}
+	if got := session3.GetCodeVerifier(); got != "" {
+		t.Errorf("expected code_verifier cleared after post-exchange verify failure, got %q", got)
+	}
+}