refactor: migrate to zitadel oidc lib

[alienvspredator]

What this PR does / why we need it:
Migrate code exchange flow to zitadel oidc library implementation.
Credentials package has been refactored so that it's compatible with the zitadel OIDC lib.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: bcdf76d8-1297-4f4c-8ef4-b915d93d07bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Summary by CodeRabbit

• Authentication

  • Improved OAuth 2.0 and OpenID Connect authentication flows.
  • Added support for insecure, client-secret, client-secret-post, and mutual TLS authentication.
  • Improved provider discovery and access-token refresh handling.

• Security

  • Added stricter ID-token validation, including issuer, audience, and timing checks.
  • Improved token introspection and handling of active sessions.

• Reliability

  • Enhanced authentication error handling and configuration validation.

Walkthrough

Changes

The PR replaces custom transport-based credential handling with Zitadel OIDC resource-server and relying-party clients. It updates OAuth2 module and gRPC wiring, migrates session authorization, token exchange, refresh, and introspection flows, and adds dynamic signed-token test fixtures with explicit claim validation.

OIDC client migration

Layer / File(s)	Summary
Credential client constructors internal/credentials/*	Adds resource-server and relying-party constructors for insecure, client-secret, and mTLS authentication.
Credential provider wiring modules/credentials/oauth2/*, modules/grpc/session/*, internal/session/options.go, go.mod, .golangci.yaml	Replaces credential builders with credentials.Provider implementations and updates module dependency registration.
Session OIDC flow internal/session/manager.go, internal/session/openid.go, internal/session/housekeeper.go, internal/session/*_test.go	Uses Zitadel discovery and relying-party APIs for authorization, code exchange, token refresh, and ID-token claim validation.
Resource-server introspection modules/grpc/session/server.go	Uses Zitadel introspection responses, active-state methods, and groups-claim conversion.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: migrating the project to the Zitadel OIDC library.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

internal/session/manager.go (1)

174-192: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Use the configured provider HTTP client for discovery and JWKS requests.

getOpenIDConfig and getProviderKeySet use http.DefaultClient, while credentials.NewTLSRP stores the mTLS client on RelyingParty.HttpClient(). If either endpoint requires mTLS, discovery can fail before the token exchange, or JWKS retrieval can fail before claim validation.

Obtain the relying-party client before these requests and pass it to both functions. Add an integration test that requires the configured client certificate.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f006c513-a72b-40d4-9daa-2b7e8ed8049a

📥 Commits

Reviewing files that changed from the base of the PR and between 13d9962 and b38856e.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (28)

• .golangci.yaml
• go.mod
• internal/credentials/clientsecretpost.go
• internal/credentials/clientsecretpost_test.go
• internal/credentials/credentials.go
• internal/credentials/credentials_test.go
• internal/credentials/insecure.go
• internal/credentials/insecure_test.go
• internal/credentials/provider.go
• internal/credentials/provider_test.go
• internal/credentials/resourceserver.go
• internal/credentials/resourceserver_test.go
• internal/credentials/tls.go
• internal/credentials/tls_test.go
• internal/debugtools/http.go
• internal/debugtools/http_test.go
• internal/session/helper_test.go
• internal/session/housekeeper.go
• internal/session/manager.go
• internal/session/manager_test.go
• internal/session/openid.go
• internal/session/options.go
• internal/sessionwiring/sessionwiring.go
• modules/credentials/oauth2/module.go
• modules/credentials/oauth2/module_test.go
• modules/grpc/session/module.go
• modules/grpc/session/options.go
• modules/grpc/session/server.go

💤 Files with no reviewable changes (5)

• internal/credentials/credentials_test.go
• internal/credentials/credentials.go
• internal/debugtools/http.go
• internal/debugtools/http_test.go
• internal/sessionwiring/sessionwiring.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.