From 6873e474be6934a35105fe43fd5f2f1d7357603c Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sun, 14 Jun 2026 14:43:12 +0000
Subject: [PATCH] fix(auth): support form_post OIDC callback and add POST
 /auth/callback route

---
 src/core/auth/oidc.go | 9 +++++++++
 src/main.go           | 1 +
 2 files changed, 10 insertions(+)

diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go
index 151f8f6..a58d369 100644
--- a/src/core/auth/oidc.go
+++ b/src/core/auth/oidc.go
@@ -73,7 +73,12 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Verify state parameter matches
+	// Get state from URL query (GET) or form body (POST form_post mode)
 	stateParam := r.URL.Query().Get("state")
+	if stateParam == "" {
+		r.ParseForm()
+		stateParam = r.Form.Get("state")
+	}
 	if stateParam == "" || stateParam != stateCookie.Value {
 		http.Error(w, "state mismatch", http.StatusForbidden)
 		return
@@ -88,7 +93,11 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
 		HttpOnly: true,
 	})
 
+	// Get code from URL query (GET) or form body (POST form_post mode)
 	code := r.URL.Query().Get("code")
+	if code == "" {
+		code = r.Form.Get("code")
+	}
 	if code == "" {
 		http.Error(w, "missing authorization code", http.StatusBadRequest)
 		return
diff --git a/src/main.go b/src/main.go
index 2db9997..d2448f5 100644
--- a/src/main.go
+++ b/src/main.go
@@ -101,6 +101,7 @@ func main() {
 	// --- OIDC auth routes (public) ---
 	mux.HandleFunc("GET /auth/login", oidcHandler.LoginRedirect)
 	mux.HandleFunc("GET /auth/callback", oidcHandler.Callback)
+	mux.HandleFunc("POST /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {
 		// Clear session cookie
 		http.SetCookie(w, &http.Cookie{