fix(auth): harden unified diagnostic execution

backend/src/auth/diagnostic-command.ts

@@ -1,31 +1,41 @@
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
 import { loadConfig, type AppConfig } from "../config.js";
-import { secretValue } from "../config/secret-bundle.js";
+import { loadSecretBundle, SECRET_BUNDLE_KEYS, secretValue } from "../config/secret-bundle.js";
 import { createAuthentikGroupCatalog } from "./authentik-group-catalog.js";
 import { createCurrentLocalUserRegistryResolver, type LocalUserRegistry } from "./local-registry.js";
 import { createOidcProtocol, OidcDeviceFlowUnavailableError, type OidcProtocol } from "./oidc-client.js";
 import { createAuthDiagnoser, type AuthDiagnoser, type AuthDiagnostic, type AuthDiagnostics } from "./diagnostics.js";
+import { decodeAuthDiagnostics, type GroupCatalog } from "./group-catalog.js";
 import type { LoadedAuthConfig } from "./types.js";
 
 const AUTH_SECRET_REFERENCES = ["THT_OIDC_CLIENT_SECRET", "THT_AUTHENTIK_API_TOKEN"] as const;
 
-function configuredSecretValues(config: AppConfig): readonly string[] {
-  const values: string[] = [];
-  for (const reference of AUTH_SECRET_REFERENCES) {
+export function configuredSecretValues(config: AppConfig): readonly string[] {
+  const values = new Set<string>();
+  if (config.secretsFile) {
     try {
-      const value = secretValue(config, reference);
-      if (value !== undefined) values.push(value);
+      for (const value of loadSecretBundle(config.secretsFile).values()) values.add(value);
+    } catch {
+      return [];
+    }
+  }
+  for (const reference of SECRET_BUNDLE_KEYS) {
+    try {
+      const value = secretValue({ secretFiles: config.secretFiles }, reference);
+      if (value !== undefined) values.add(value);
     } catch {
       // The fixed report below is the only externally-visible failure surface.
     }
   }
-  return values;
+  return [...values];
 }
 
 export interface ConfiguredAuthDiagnoserOptions {
   localUserRegistry?: (loaded: LoadedAuthConfig) => LocalUserRegistry | undefined;
   oidcProtocol?: (loaded: LoadedAuthConfig) => OidcProtocol | undefined;
+  groupCatalog?: (loaded: LoadedAuthConfig) => GroupCatalog | undefined;
+  sessionRootValidator?: (root: string) => void | Promise<void>;
 }
 
 /** Builds the one shared auth diagnostic implementation used by app routes and the one-shot CLI. */
@@ -70,7 +80,7 @@ export function createConfiguredAuthDiagnoser(
           } catch { return undefined; }
         })()
         : undefined;
-      const groupCatalog = current?.value.mode === "oidc" ? (() => {
+      const groupCatalog = current?.value.mode === "oidc" ? options.groupCatalog?.(current) ?? (() => {
         try {
           const token = secretValues().get("THT_AUTHENTIK_API_TOKEN");
           return token === undefined ? undefined : createAuthentikGroupCatalog({
@@ -82,6 +92,7 @@ export function createConfiguredAuthDiagnoser(
       const report = await createAuthDiagnoser({
         authMode: config.authMode,
         authStateRoot: config.authStateRoot,
+        ...(options.sessionRootValidator === undefined ? {} : { sessionRootValidator: options.sessionRootValidator }),
         authentication: config.authentication,
         secrets: secretValues(),
         localUserRegistry: current?.value.mode === "local"
@@ -108,10 +119,21 @@ export function createConfiguredAuthDiagnoser(
         );
         // Exact names only: unrelated provider groups are neither emitted nor retained.
         const mappedRoles = new Set<string>();
-        for (const group of identity.groups) {
-          for (const role of current.value.authorization.groupRoles[group] ?? []) mappedRoles.add(role);
+        for (const [configuredGroup, roles] of Object.entries(current.value.authorization.groupRoles)) {
+          if (!identity.groups.includes(configuredGroup)) continue;
+          for (const role of roles) mappedRoles.add(role);
+        }
+        if (mappedRoles.size === 0) {
+          return {
+            ready: false,
+            mode: "oidc",
+            checks: [{
+              level: "error",
+              code: "oidc_groups_claim_invalid",
+              message: "The OIDC device-flow identity could not be validated.",
+            }],
+          };
         }
-        void mappedRoles;
         return report;
       } catch (error) {
         return {
@@ -188,18 +210,22 @@ export async function runDiagnosticCommand(
     return 2;
   }
   let report: AuthDiagnostics;
+  const secrets = dependencies.secretValues ?? [];
   try {
     report = await dependencies.diagnoser.inspect({
       live: true,
       ...(options.interactive ? {
         interactive: true,
-        presentDeviceCode: (uri: string, code: string) => dependencies.stderr(`Open ${uri} and enter code ${code}`),
+        presentDeviceCode: (uri: string, code: string) => dependencies.stderr(
+          redact(`Open ${uri} and enter code ${code}`, secrets),
+        ),
       } : {}),
     });
   } catch {
     report = genericFailure();
   }
-  const safe = redactedReport(report, dependencies.secretValues ?? []);
+  const decoded = decodeAuthDiagnostics(report) ?? genericFailure();
+  const safe = decodeAuthDiagnostics(redactedReport(decoded, secrets)) ?? genericFailure();
   dependencies.stdout(`${JSON.stringify(safe)}\n`);
   return safe.ready ? 0 : 1;
 }