fix(oidc): Add state parameter and validate nonce against login CSRF

The OIDC implicit-flow authorize request carried no state parameter and
the nonce was generated with weak Math.random() and never validated
client- or server-side, enabling login CSRF / forced authentication /
replay (AUTHZ-VULN-05).

Generate state and nonce with the Web Crypto CSPRNG, send state in the
authorize request, and validate both state and the id_token nonce claim
in the callback before storing tokens. Forward the nonce to /validate-
token so the backend also binds the id_token to the login flow.

Fixes the forged-callback fragment attack where a planted id_token with
a mismatched nonce was accepted, stored, and used by the SPA.

tests/test_main.py

@@ -106,6 +106,41 @@ def test_validate_token_invalid(mock_verify_token):
     assert not data["valid"]
     assert data["error"] == "Invalid token"
 
+@patch('main.verify_token')
+def test_validate_token_passes_nonce_to_verify(mock_verify_token):
+    """The endpoint must forward the supplied nonce to verify_token (anti-replay binding)."""
+    mock_verify_token.return_value = {
+        "email": "rene.luria@infomaniak.com",
+        "iss": "https://login.infomaniak.com",
+        "aud": "test-client-id",
+        "nonce": "abc123",
+    }
+
+    response = client.post("/validate-token", json={
+        "id_token": "valid.token.here",
+        "nonce": "abc123"
+    })
+
+    assert response.status_code == 200
+    assert response.json()["valid"]
+    # verify_token must have been called with the nonce as the second positional arg
+    assert mock_verify_token.call_args.args[1] == "abc123"
+
+@patch('main.verify_token')
+def test_validate_token_rejects_nonce_mismatch(mock_verify_token):
+    """A mismatched nonce (forced-auth / replay token) is rejected by the backend."""
+    mock_verify_token.side_effect = ValueError("Nonce mismatch: token is not bound to this login")
+
+    response = client.post("/validate-token", json={
+        "id_token": "forged.token.here",
+        "nonce": "abc123"
+    })
+
+    assert response.status_code == 200
+    data = response.json()
+    assert not data["valid"]
+    assert "Nonce mismatch" in data["error"]
+
 def test_validate_token_empty_request():
     """Test validation with empty token."""
     response = client.post("/validate-token", json={

tests/test_token_validation.py

@@ -58,6 +58,99 @@ def test_verify_token_no_matching_key(mock_get_header, mock_get_jwks):
     with pytest.raises(ValueError, match="Unable to find matching key in JWKS"):
         verify_token("some.token.string")
 
+
+def _mock_jwks_and_key():
+    """Helper: return (jwks, header) fixtures for reaching the jwt.decode step."""
+    jwks = {
+        "keys": [
+            {"kid": "test-key-id", "kty": "RSA", "n": "modulus", "e": "AQAB"}
+        ]
+    }
+    header = {"kid": "test-key-id", "alg": "RS256"}
+    return jwks, header
+
+
+@patch('main.jwt.decode')
+@patch('main.jwt.algorithms.RSAAlgorithm.from_jwk')
+@patch('main.jwt.get_unverified_header')
+@patch('main.get_jwks')
+def test_verify_token_nonce_match(mock_get_jwks, mock_get_header, mock_from_jwk, mock_decode):
+    """verify_token returns payload when expected_nonce matches the token nonce."""
+    jwks, header = _mock_jwks_and_key()
+    mock_get_jwks.return_value = jwks
+    mock_get_header.return_value = header
+    mock_from_jwk.return_value = "mock-key"
+    mock_decode.return_value = {
+        "iss": "https://login.infomaniak.com",
+        "aud": "test-client-id",
+        "email": "rene.luria@infomaniak.com",
+        "nonce": "abc123",
+    }
+
+    payload = verify_token("some.token.string", expected_nonce="abc123")
+    assert payload["nonce"] == "abc123"
+
+
+@patch('main.jwt.decode')
+@patch('main.jwt.algorithms.RSAAlgorithm.from_jwk')
+@patch('main.jwt.get_unverified_header')
+@patch('main.get_jwks')
+def test_verify_token_nonce_mismatch(mock_get_jwks, mock_get_header, mock_from_jwk, mock_decode):
+    """verify_token rejects an id_token whose nonce does not match the expected one."""
+    jwks, header = _mock_jwks_and_key()
+    mock_get_jwks.return_value = jwks
+    mock_get_header.return_value = header
+    mock_from_jwk.return_value = "mock-key"
+    mock_decode.return_value = {
+        "iss": "https://login.infomaniak.com",
+        "aud": "test-client-id",
+        "email": "attacker@evil.com",
+        "nonce": "VERYWRONG_NONCE",
+    }
+
+    with pytest.raises(ValueError, match="Nonce mismatch"):
+        verify_token("some.token.string", expected_nonce="abc123")
+
+
+@patch('main.jwt.decode')
+@patch('main.jwt.algorithms.RSAAlgorithm.from_jwk')
+@patch('main.jwt.get_unverified_header')
+@patch('main.get_jwks')
+def test_verify_token_nonce_missing_in_token(mock_get_jwks, mock_get_header, mock_from_jwk, mock_decode):
+    """verify_token rejects a token lacking a nonce claim when an expected nonce is supplied."""
+    jwks, header = _mock_jwks_and_key()
+    mock_get_jwks.return_value = jwks
+    mock_get_header.return_value = header
+    mock_from_jwk.return_value = "mock-key"
+    mock_decode.return_value = {
+        "iss": "https://login.infomaniak.com",
+        "aud": "test-client-id",
+        "email": "rene.luria@infomaniak.com",
+    }
+
+    with pytest.raises(ValueError, match="Token missing nonce claim"):
+        verify_token("some.token.string", expected_nonce="abc123")
+
+
+@patch('main.jwt.decode')
+@patch('main.jwt.algorithms.RSAAlgorithm.from_jwk')
+@patch('main.jwt.get_unverified_header')
+@patch('main.get_jwks')
+def test_verify_token_nonce_not_checked_when_none(mock_get_jwks, mock_get_header, mock_from_jwk, mock_decode):
+    """verify_token skips the nonce check when no expected_nonce is provided (returning visits / refresh)."""
+    jwks, header = _mock_jwks_and_key()
+    mock_get_jwks.return_value = jwks
+    mock_get_header.return_value = header
+    mock_from_jwk.return_value = "mock-key"
+    mock_decode.return_value = {
+        "iss": "https://login.infomaniak.com",
+        "aud": "test-client-id",
+        "email": "rene.luria@infomaniak.com",
+    }
+
+    payload = verify_token("some.token.string")
+    assert payload["email"] == "rene.luria@infomaniak.com"
+
 @patch('main.requests.get')
 def test_get_well_known_config_success(mock_get):
     """Test successful retrieval of well-known configuration."""