test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r181_regression_test.go

@@ -0,0 +1,90 @@
+package traefikoidc
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// ============================================================================
+// R181: DCR secret with finite client_secret_expires_at must be re-registered
+// ---------------------------------------------------------------------------
+// performDynamicClientRegistration installed a client once and update-
+// MetadataEndpoints' gate was "clientID == \"\"" — so a provider that
+// returns a finite client_secret_expires_at had its install be a one-shot:
+// once the secret lapsed, the 2h metadata refresh (the only path re-running
+// the gate) saw clientID != "" and never re-registered, and every token
+// exchange then failed invalid_client with no self-heal. The gate now
+// re-registers when the installed secret has expired (or is within the
+// 5-minute buffer areCredentialsValid uses on the load path).
+// Fail-on-old: the second refresh sees clientID != "" and skips re-registration.
+func TestR181_DCRReRegistersWhenSecretExpired(t *testing.T) {
+	var regCount atomic.Int32
+	ts := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		regCount.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(ClientRegistrationResponse{
+			ClientID:              "reg-client",
+			ClientSecret:          "reg-secret",
+			ClientSecretExpiresAt: time.Now().Add(time.Hour).Unix(),
+		})
+	}))
+	defer ts.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	tObj := &TraefikOidc{
+		logger:      GetSingletonNoOpLogger(),
+		httpClient:  ts.Client(),
+		ctx:         ctx,
+		providerURL: ts.URL,
+		dcrConfig: &DynamicClientRegistrationConfig{
+			Enabled: true,
+			ClientMetadata: &ClientRegistrationMetadata{
+				RedirectURIs: []string{"https://example.com/callback"},
+			},
+		},
+	}
+
+	md := &ProviderMetadata{
+		Issuer:          ts.URL,
+		RegistrationURL: ts.URL,
+	}
+
+	// First refresh installs a client with a 1h secret.
+	tObj.updateMetadataEndpoints(md)
+	if got := regCount.Load(); got != 1 {
+		t.Fatalf("expected one registration on first refresh, got %d", got)
+	}
+	if tObj.clientID == "" {
+		t.Fatal("expected DCR to have installed a client ID")
+	}
+	if tObj.dcrRegistrationNeeded() {
+		t.Fatal("a freshly registered, non-expired secret must not need re-registration")
+	}
+
+	// Simulate the installed secret having lapsed since the last refresh.
+	tObj.metadataMu.Lock()
+	tObj.clientSecretExpiresAt = time.Now().Add(-time.Hour).Unix()
+	tObj.metadataMu.Unlock()
+
+	// Next metadata refresh must re-register (self-heal) rather than keep
+	// the dead secret.
+	tObj.updateMetadataEndpoints(md)
+	if got := regCount.Load(); got != 2 {
+		t.Errorf("expired DCR secret must be re-registered on refresh: got %d registrations, want 2", got)
+	}
+
+	// A non-expiring secret (exp=0) must keep the installed client.
+	tObj.metadataMu.Lock()
+	tObj.clientSecretExpiresAt = 0
+	tObj.metadataMu.Unlock()
+	if tObj.dcrRegistrationNeeded() {
+		t.Error("a non-expiring secret (client_secret_expires_at = 0) must keep the installed client")
+	}
+}