fix(auth): bypass OIDC challenge when placeholder Auth0 config is active (#396)

[mpaulosky]

Summary

Closes #396

Working as Gandalf (Security Officer)

Problem

In Development/Testing with no real Auth0 credentials configured, Program.cs falls back to the placeholder domain test.auth0.com. Navigating to /Account/Login then triggers a real OIDC discovery call against that non-existent domain, producing IDX20803: Unable to obtain configuration from … test.auth0.com after a full timeout.

Fix

isPlaceholderAuth0Config flag — set to true only when placeholder values are active. Developers with real user-secrets configured are completely unaffected; the flag stays false and the Auth0 Universal Login flow is preserved.

/Account/Login short-circuit — when the flag is true, the endpoint redirects immediately to /test/login (the existing cookie-based test login) instead of issuing a ChallengeAsync to the placeholder domain.

existingOnTokenValidated null guard — added if (existingOnTokenValidated != null) before invoking the captured delegate (PR #2 audit finding — latent NullReferenceException on every real login when Auth0 SDK leaves the delegate null).

Files changed

File	Change
src/Web/Program.cs	Flag, null-guard, /Account/Login short-circuit
docs/AUTH0_SETUP.md	New troubleshooting entry: IDX20803 timeout pattern
.squad/agents/gandalf/history.md	Key learnings appended

Security test scenarios for Gimli

1. GET /Account/Login when isPlaceholderAuth0Config = true → assert 302 to /test/login, no OIDC challenge issued.
2. GET /Account/Login when real Auth0 credentials are configured → assert OIDC challenge (302 to Auth0 domain), /test/login NOT called.
3. Production startup without credentials → assert InvalidOperationException is thrown.
4. GET /test/login in Development → assert cookie set, redirect to /, user authenticated.
5. GET /test/login in Production → assert 404 (endpoint not registered).
6. OnTokenValidated with null prior handler → assert no NullReferenceException; role claims added normally.

Pre-push gates

All 7 gates passed locally (build Release ✅, 420 unit tests ✅, 56 integration/E2E tests ✅).

[Copilot]

Pull request overview

This PR improves the local Development/Testing login experience when Auth0 configuration is missing by avoiding an OIDC discovery call to the placeholder test.auth0.com domain, while keeping the real Auth0 flow unchanged for developers who have configured credentials.

Changes:

• Introduces an isPlaceholderAuth0Config flag and uses it to short-circuit /Account/Login to the existing /test/login endpoint in Development/Testing.
• Adds a null-guard when invoking a captured OnTokenValidated delegate to prevent NullReferenceException.
• Documents the IDX20803 timeout pattern and the intended fallback behavior in Auth0 setup docs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/Web/Program.cs	Adds placeholder-config detection, bypasses OIDC challenge in placeholder mode, and guards OnTokenValidated delegate invocation.
docs/AUTH0_SETUP.md	Adds troubleshooting guidance for IDX20803 timeouts when placeholder Auth0 config is used locally.
.squad/agents/gandalf/history.md	Records the issue context, fix details, and suggested test scenarios for the squad security agent history.

Comments suppressed due to low confidence (1)

src/Web/Program.cs:63

• Production/staging config validation uses string.IsNullOrEmpty for Auth0:Domain and Auth0:ClientId, so whitespace-only values would pass startup checks but still break OIDC later. Using string.IsNullOrWhiteSpace here (to match the Dev/Testing branch) would fail fast on clearly invalid configuration.

if (!builder.Environment.IsDevelopment() && !builder.Environment.IsEnvironment("Testing"))
{
	if (string.IsNullOrEmpty(auth0Domain) || string.IsNullOrEmpty(auth0ClientId))
	{
		throw new InvalidOperationException(
				"Auth0 configuration is missing or incomplete. Set these user secrets for the Web project:\n" +
				"  dotnet user-secrets set \"Auth0:Domain\" \"<your-tenant>.auth0.com\" --project src/Web\n" +
				"  dotnet user-secrets set \"Auth0:ClientId\" \"<your-client-id>\" --project src/Web\n" +
				"  dotnet user-secrets set \"Auth0:ClientSecret\" \"<your-client-secret>\" --project src/Web");
	}

[github-actions]

Test Results Summary

514 tests  +2   512 ✅ +1   37s ⏱️ ±0s
  6 suites ±0     1 💤 ±0 
  6 files   ±0     1 ❌ +1 

For more details on these failures, see this check.

Results for commit b5bf7e8. ± Comparison against base commit 7107862.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.46%. Comparing base (7107862) to head (c687b53).
⚠️ Report is 1 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #397   +/-   ##
=======================================
  Coverage   85.46%   85.46%           
=======================================
  Files          70       70           
  Lines        1693     1693           
  Branches      207      207           
=======================================
  Hits         1447     1447           
  Misses        166      166           
  Partials       80       80           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mpaulosky]

Gimli update: added AppHost coverage for /Account/Login in Testing to prove it redirects locally to /test/login (never test.auth0.com), plus an Architecture contract test that pins the placeholder short-circuit before ChallengeAsync while preserving the real Auth0 path. Local validation passed: Architecture.Tests 17/17, AppHost.Tests 56 passed with 1 existing skip, and Release build succeeded.