Preserve complete issuer paths when constructing OIDC discovery URLs

[Bakar404]

Outcome

Production OIDC initialization should resolve discovery metadata for issuers with path components, including Entra v2 and realm-based issuers, without changing authentication or authorization policy.

Confirmed source finding

At b2523964e7576cafc00e84a51e1044f55826dea7, crates/crony-server/src/auth.rs:147–159 trims the trailing slash and then joins .well-known/openid-configuration relatively. Native URL joining replaces the final issuer path component instead of appending to the complete issuer.

An isolated contribution already contains a bounded fix using the pinned URL path-segment API and regression evidence. It is uncommitted/unpublished; recover and review that contribution rather than reimplementing it.

Acceptance

• Preserve root, nested, trailing-slash and percent-encoded issuer paths when appending the discovery suffix.
• Preserve HTTPS checks, discovery-issuer comparison, query/fragment behavior, principal mapping and authorization.
• Cover root, nested, Entra-shaped, encoded-path, mismatched-issuer and production-HTTP rejection cases.
• Review the existing focused regression and rerun appropriate repository gates on the exact publication candidate.
• Report discovery compatibility separately from real provider sign-in, browser onboarding and deployment acceptance.

Related: #16, #242, #248. This narrow fix does not close those workstreams or authorize their pending execution/review scopes.

Local evidence, not yet published: docs/evidence/2026-09-13-oidc-discovery-issuer-path.md records two relevant baseline failures and eight fixed-suite passes; docs/evidence/2026-09-13-azure-readiness-repository-gate.md records the historical repository gate. Those checks were not rerun during the read-only audit.

[VirtualAdam]

The Azure-backed Base Sepolia qualification for #287 / draft #293 depends on this production OIDC discovery compatibility fix.

The existing issue records an unpublished, uncommitted contribution, but its patch and evidence files are not present in the available ECorp checkouts. The published auth source still uses the relative URL join. Please link the existing branch, patch, or contribution location so we can reuse and review it rather than create a duplicate implementation.

The Azure signer contribution is separately tracked in #295. Local signer checks and infrastructure preparation are not production OIDC sign-in evidence; development authentication will not be substituted for the live acceptance lane. The historical results described above have not been rerun on a recovered #270 publication candidate.

[Bakar404]

@VirtualAdam — found the original #270 contribution. The preserved local contribution is codex/azure-production-readiness under .ecorp/contributions/azure-production-readiness, based on b2523964e7576cafc00e84a51e1044f55826dea7. Its source changes are still uncommitted; there is no published branch containing this fix.

The original patch and both evidence files are included in full below, so this comment is the GitHub-accessible recovery handoff for reuse and review in the existing #287 / #293 workflow. This is not a duplicate implementation or a newly validated publication candidate.

The patch contains only:

• crates/crony-server/src/auth.rs: the existing native URL path-segment fix and original regression tests (130 additions, 3 deletions).
• docs/evidence/2026-09-13-oidc-discovery-issuer-path.md: original focused report (63 lines).
• docs/evidence/2026-09-13-azure-readiness-repository-gate.md: original repository-gate report (57 lines).

The original worktree also has unrelated Azure artifact/storage, owner-bootstrap, and startup work. Those changes, manifests/lockfiles, and private .azure/ planning contents are not included. The original worktree and its empty index were preserved; no new branch, commit, PR, merge, or deployment was created for this handoff.

Evidence status: the September 13 reports are retained unchanged. They record 8 focused passes and a historical workspace result of 554 passed / 0 failed / 323 ignored; these are historical observations, not fresh runs. Neither those suites nor the repository gates have been rerun for this recovery. Today's checks were limited to exact patch capture, file-scope/integrity verification, and a successful read-only git apply --reverse --check against the preserved contribution. That check confirms the patch matches the recovered files; it does not establish runtime correctness or acceptance.

Agreed on the boundary: #295 remains the separate Azure signer contribution. Local signer checks, infrastructure preparation, and these discovery fixtures do not establish real production OIDC sign-in, browser onboarding, or live Base Sepolia acceptance. Development authentication will not substitute for the live lane. Appropriate checks still need to run on the exact agreed publication/integration candidate; this handoff does not close #270 or the broader qualification gates.

Recovered original patch — auth fix/tests and both unchanged historical evidence reports

Copy only the diff block to issue270-recovered.patch as UTF-8 with LF line endings and a final newline. Patch SHA-256: 3ffe25fc18724601c8c1fdb9e22e427f91b8261184c1ce3055c1b4564ce771d5.

Review/apply it in a separate review worktree at the stated base, not in the mixed original contribution. Inspect git apply --stat issue270-recovered.patch and git apply --check issue270-recovered.patch first. Those are patch checks, not replacement test evidence.

diff --git a/crates/crony-server/src/auth.rs b/crates/crony-server/src/auth.rs
index e655b543b9564bc2633655407005e9d6f17d4d9c..913234a895ecb2258ab6e0e66c2a3a2d16bfbadb 100644
--- a/crates/crony-server/src/auth.rs
+++ b/crates/crony-server/src/auth.rs
@@ -154,9 +154,17 @@ impl AuthService {
                 "production OIDC issuer must use https; use --allow-insecure-oidc only for isolated tests"
             ));
         }
-        let discovery_url = issuer_url
-            .join(".well-known/openid-configuration")
-            .context("construct OIDC discovery URL")?;
+        // OIDC appends discovery to the full issuer path. A relative URL join
+        // would replace the last segment (for example Entra's `v2.0`).
+        let mut discovery_url = issuer_url;
+        discovery_url
+            .path_segments_mut()
+            .map_err(|_| anyhow!("construct OIDC discovery URL: issuer cannot be a base URL"))?
+            .pop_if_empty()
+            .extend([".well-known", "openid-configuration"]);
+        // Preserve the prior relative join's query/fragment clearing behavior.
+        discovery_url.set_query(None);
+        discovery_url.set_fragment(None);
         let discovery = client
             .get(discovery_url)
             .send()
@@ -295,6 +303,125 @@ impl AuthService {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use axum::{Json, Router, routing::get};
+    use serde_json::json;
+
+    struct DiscoveryFixture {
+        issuer: String,
+        server: tokio::task::JoinHandle<()>,
+    }
+
+    impl Drop for DiscoveryFixture {
+        fn drop(&mut self) {
+            self.server.abort();
+        }
+    }
+
+    async fn discovery_fixture(path: &str, mismatched_issuer: bool) -> DiscoveryFixture {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind test-owned discovery endpoint");
+        let issuer = format!("http://{}{path}", listener.local_addr().unwrap());
+        let discovered_issuer = if mismatched_issuer {
+            format!("{issuer}/different-issuer")
+        } else {
+            issuer.clone()
+        };
+        let document_path = format!("{path}/.well-known/openid-configuration");
+        let app = Router::new().route(
+            &document_path,
+            get(move || {
+                let discovered_issuer = discovered_issuer.clone();
+                async move {
+                    Json(json!({
+                        "issuer": discovered_issuer,
+                        "userinfo_endpoint": "https://identity.example.test/userinfo"
+                    }))
+                }
+            }),
+        );
+        let server = tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+        DiscoveryFixture { issuer, server }
+    }
+
+    async fn assert_discovery_at_issuer_path(path: &str) {
+        let fixture = discovery_fixture(path, false).await;
+        for suffix in ["", "/"] {
+            let auth = AuthService::initialize(
+                ServerMode::Production,
+                Some(format!("{}{suffix}", fixture.issuer)),
+                true,
+            )
+            .await
+            .unwrap_or_else(|error| panic!("discovery for {path:?}{suffix} failed: {error:#}"));
+            assert_eq!(auth.mode(), ServerMode::Production);
+            assert_eq!(auth.issuer.as_deref(), Some(fixture.issuer.as_str()));
+            assert_eq!(
+                auth.userinfo_endpoint.unwrap().as_str(),
+                "https://identity.example.test/userinfo"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn discovery_supports_root_issuer_with_or_without_trailing_slash() {
+        assert_discovery_at_issuer_path("").await;
+    }
+
+    #[tokio::test]
+    async fn discovery_preserves_nested_issuer_path() {
+        assert_discovery_at_issuer_path("/realms/ecorp").await;
+    }
+
+    #[tokio::test]
+    async fn discovery_preserves_entra_v2_issuer_path() {
+        assert_discovery_at_issuer_path("/00000000-0000-4000-8000-000000000001/v2.0").await;
+    }
+
+    #[tokio::test]
+    async fn discovery_preserves_percent_encoded_issuer_path() {
+        assert_discovery_at_issuer_path("/realms/ecorp%20test").await;
+    }
+
+    #[tokio::test]
+    async fn discovery_still_rejects_mismatched_issuer() {
+        let fixture = discovery_fixture("", true).await;
+        let result =
+            AuthService::initialize(ServerMode::Production, Some(fixture.issuer.clone()), true)
+                .await;
+        let error = result.err().expect("a foreign issuer must be rejected");
+        assert!(error.to_string().contains("OIDC discovery issuer mismatch"));
+    }
+
+    #[tokio::test]
+    async fn production_still_requires_https_without_test_override() {
+        let result = AuthService::initialize(
+            ServerMode::Production,
+            Some("http://127.0.0.1:1/tenant/v2.0".to_owned()),
+            false,
+        )
+        .await;
+        let error = result
+            .err()
+            .expect("plaintext production issuer must be rejected");
+        assert!(
+            error
+                .to_string()
+                .contains("production OIDC issuer must use https")
+        );
+    }
+
+    #[tokio::test]
+    async fn development_does_not_require_discovery() {
+        let auth = AuthService::initialize(ServerMode::Development, None, false)
+            .await
+            .unwrap();
+        assert_eq!(auth.mode(), ServerMode::Development);
+        assert!(auth.issuer.is_none());
+        assert!(auth.userinfo_endpoint.is_none());
+    }
 
     #[test]
     fn role_matrix_is_fail_closed() {
diff --git a/docs/evidence/2026-09-13-oidc-discovery-issuer-path.md b/docs/evidence/2026-09-13-oidc-discovery-issuer-path.md
new file mode 100644
index 0000000000000000000000000000000000000000..5bb35402948ad674b6114721f9ad25d18137ccca
--- /dev/null
+++ b/docs/evidence/2026-09-13-oidc-discovery-issuer-path.md
@@ -0,0 +1,63 @@
+# OIDC discovery retains the complete issuer path
+
+Date: September 13, 2026. Scope: isolated authentication compatibility fix and focused local regression evidence.
+
+Base: `b2523964e7576cafc00e84a51e1044f55826dea7`.
+Contribution branch: `codex/azure-production-readiness` (uncommitted at this checkpoint).
+
+## Findings and change
+
+`AuthService::initialize` used a relative URL join after trimming an issuer's trailing slash. URL joining treats the final path segment as a file: an issuer ending in `/tenant/v2.0` therefore requested `/tenant/.well-known/openid-configuration`, not the OpenID Connect document appended to the full issuer path. The same defect affected nested issuers such as `/realms/ecorp`.
+
+The fix appends `.well-known` and `openid-configuration` using the existing `url` library's native path-segment API. Existing path bytes, including percent-encoded segments, are retained. The prior query/fragment clearing behavior, trailing-slash normalization, HTTPS enforcement, discovery-issuer comparison, principal mapping, and authorization policy are unchanged.
+
+Harness-first check: reuse the pinned `url` 2.5.8 implementation (through `reqwest::Url`), existing `AuthService`, and existing Axum/Tokio test dependencies. No new dependency, custom authentication system, token persistence, or lockfile change is introduced.
+
+## Validation
+
+Environment: Windows ARM64; cargo 1.98.1 and rustc 1.98.1. The isolated worktree's own `target` directory was used with two compilation jobs. `DATABASE_URL` and `CRONY_ACCESS_TOKEN` were removed from the test command's process environment. Dependencies were resolved offline with the lockfile enforced.
+
+```powershell
+cargo test --offline --locked -p crony-server auth::tests -- --test-threads=1
+cargo fmt --check
+git diff --check
+```
+
+| Stage | Result |
+| --- | --- |
+| New regression tests against original implementation | Expected failure: 5 passed, 2 failed, 124 filtered out |
+| Initial formatting check | Two formatting-only differences in the new test code; subsequently corrected |
+| Focused tests after fix, including encoded-path case | 8 passed, 0 failed, 0 ignored, 124 filtered out; exit 0 |
+| Final `cargo fmt --check` | Exit 0 |
+| `git diff --check` | Exit 0 |
+
+Before the fix, both `discovery_preserves_nested_issuer_path` and `discovery_preserves_entra_v2_issuer_path` returned HTTP 404 from the fixture because the request omitted the last issuer segment.
+
+Passing coverage:
+
+- root issuer with and without a trailing slash;
+- nested issuer path with and without a trailing slash;
+- Entra-shaped tenant plus `v2.0` path, with and without a trailing slash;
+- percent-encoded issuer path without double encoding;
+- foreign discovery issuer rejection;
+- HTTP production issuer rejection when the explicit isolated-test override is absent;
+- development initialization without discovery;
+- the existing fail-closed role matrix.
+
+Tests use a test-owned loopback listener on an OS-assigned port. A fixture guard aborts the Axum task when dropped, including assertion unwind. HTTP is enabled only through the existing explicit isolated-test override. UserInfo is not called, and no real identity token is used.
+
+## Limits and unchanged authority
+
+This is not a completed Microsoft Entra browser login, tenant-consent test, token-flow security review, production deployment, or browser/server/runner/provider acceptance claim. Full repository validation remains required before committing; only the approved focused checks ran here.
+
+Subsequent checkpoint: the [full repository gate](2026-09-13-azure-readiness-repository-gate.md) passed against this contribution. The original focused-test observations above are retained unchanged; real sign-in and deployment acceptance remain separate.
+
+Related work: [#242 browser authentication](https://github.com/All-The-Vibes/ecorp/issues/242) and [#248 private deployment/recovery](https://github.com/All-The-Vibes/ecorp/issues/248). This narrow compatibility fix does not close either issue or supersede their existing review requirements. Azure Blob compatibility, production browser onboarding, infrastructure readiness, and shared-authority integration remain separate gates.
+
+No Azure resource/provider/app/role changes, factory dispatch, GitHub mutation, deployment, merge, source-checkout update, retained-database operation, or runner-identity replacement is part of this checkpoint. Private subscription inventory and planning notes are under Git-ignored `.azure/`; they must not be included in a public review payload.
+
+## References
+
+- [OpenID Connect Discovery 1.0, Provider Configuration Request](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest).
+- [Pinned URL path-segment API](https://docs.rs/url/2.5.8/url/struct.PathSegmentsMut.html).
+- [Microsoft identity platform OpenID Connect metadata](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc).
diff --git a/docs/evidence/2026-09-13-azure-readiness-repository-gate.md b/docs/evidence/2026-09-13-azure-readiness-repository-gate.md
new file mode 100644
index 0000000000000000000000000000000000000000..9c2931472abc722441aa6fa8ad7372cbb93e4a13
--- /dev/null
+++ b/docs/evidence/2026-09-13-azure-readiness-repository-gate.md
@@ -0,0 +1,57 @@
+# Azure readiness contribution: full repository gate
+
+Date: September 13, 2026. Source base: `b2523964e7576cafc00e84a51e1044f55826dea7`.
+Branch: `codex/azure-production-readiness`; Entra discovery changes remained uncommitted during validation.
+
+## Scope
+
+This follows the [isolated discovery regression/fix](2026-09-13-oidc-discovery-issuer-path.md). It records the full repository gate against that contribution, not a production deployment or real Entra sign-in.
+
+Toolchain: Windows ARM64, Node 24.19.0, pnpm 11.19.0, cargo 1.98.1, rustc 1.98.1. Rust build artifacts remained in the contribution's own `target` directory with two compilation jobs. No dependency manifest or lockfile changed.
+
+## Commands and results
+
+| Check | Actual command | Result |
+| --- | --- | --- |
+| Migration integrity | `node tools/check_migrations.mjs` | Exit 0; 41 migrations, latest 41, immutable checksums true |
+| Rust formatting | `cargo fmt --check` | Exit 0 |
+| Workspace/all-target lint | `cargo clippy --offline --locked --workspace --all-targets -- -D warnings` | Exit 0; completed in 3m 39s |
+| Workspace tests | `cargo test --offline --locked --workspace --quiet` | Exit 0; 554 passed, 0 failed, 323 ignored |
+| Web build | `pnpm build:web` | Exit 0; TypeScript and Vite build passed |
+| Web lint | `pnpm lint:web` | Exit 0 |
+| Diff whitespace | `git diff --check` | Exit 0 |
+
+Before the web checks, `pnpm install --frozen-lockfile` reused 27 packages and downloaded none. Rust dependency resolution was offline and locked. Test execution used the normal default concurrency; it was not replaced by a serial-only run. `DATABASE_URL`, `CRONY_ACCESS_TOKEN`, `GH_TOKEN`, and `GITHUB_TOKEN` were removed from the workspace-test process environment. Ignored opt-in tests were not activated.
+
+Nonempty test-suite summaries (passed / failed / ignored):
+
+```text
+116 / 0 / 0
+ 16 / 0 / 0
+  6 / 0 / 0
+  2 / 0 / 0
+  2 / 0 / 0
+ 10 / 0 / 0
+213 / 0 / 1    runner
+128 / 0 / 4    server
+ 61 / 0 / 318  store
+--------------------
+554 / 0 / 323  total
+```
+
+Zero-test binary/doc-test targets also exited successfully.
+
+## Preservation checks
+
+The configured source checkout remained clean at `971445e1cbf9388c51803e2adf28b11bd98b1ffa`. The retained API continued to report `status: ok`, development mode, and one connected runner. Its recorded server, runner, and web process IDs were unchanged. Existing runner credentials, the retained database, source selection, factory history, and budget authority were not changed.
+
+## Limits
+
+- This is a local repository gate on the stated toolchain, not an MSRV or cross-platform matrix result.
+- The 323 ignored tests are not passes; opt-in database, provider, and platform qualifications remain separate.
+- Real Entra browser sign-in, production principal provisioning, private deployment, backup/restore, and browser/server/runner/provider acceptance have not been established by this run.
+- #241 reports separate immutable-principal-link groundwork; the baseline's development-only link endpoint must not be promoted to production or used to bypass that reviewed work.
+- #242 remains behind its existing browser-auth review gate. #248's storage and lifecycle work retains its own integration/acceptance requirements.
+- No Azure resources, providers, app registrations, tenant roles, or consent grants were created or modified. No GitHub write, commit, push, merge, or deployment occurred.
+
+Local, Git-ignored planning files contain the tenant-specific sign-in preview and subscription context. They are not part of a public review payload. This report does not close #241, #242, or #248.

[VirtualAdam]

Original contribution recovered for the #293 qualification dependency

Recovered Bakar404's original contribution from #270 (comment) rather than implementing a replacement.

• Original base: b2523964e7576cafc00e84a51e1044f55826dea7.
• Original patch SHA-256: 3ffe25fc18724601c8c1fdb9e22e427f91b8261184c1ce3055c1b4564ce771d5.
• Exactly the original three files were applied in an isolated local review branch, contrib/270-oidc-discovery-closeout. Both historical evidence documents remain unchanged and are not fresh test results.
• Fresh focused execution: baseline auth 1 passed; recovered auth 8 passed, 0 failed/ignored, 124 filtered. Formatting, targeted server/all-target Clippy, patch integrity and whitespace checks passed. Dependencies resolved offline with a separate Cargo target and two build jobs. Phoenix trace: 12 rows, intact.

Integration remains separate: read-only applicability testing found that this exact patch does not apply cleanly to published #293 head b0e0768e75cfa410ad73975aede5f7444e54435c. The added owner/admin spending test changes the context of the recovered test hunk at auth.rs:295. No conflict resolution or integration into #293/#295 was performed. The existing spending test must be preserved when reconciling the original contribution.

No commit, push, PR, cloud-resource change or production Entra sign-in was performed. This removes the missing-source prerequisite and establishes focused local results at the original base; it does not establish current full-workspace acceptance, production authentication, or live Base Sepolia qualification.