fix: harden m365 auth server broker

Author: automagik-genie

auth-server/Dockerfile

@@ -1,13 +1,14 @@
 # syntax=docker/dockerfile:1.7
 
-FROM golang:1.25-alpine AS build
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
+ARG TARGETARCH
 WORKDIR /src
 
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . ./
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o /out/workit-auth-server .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/workit-auth-server .
 
 FROM gcr.io/distroless/static-debian12:nonroot
 WORKDIR /app

auth-server/README.md

@@ -101,13 +101,10 @@ services:
       - WK_CLIENT_SECRET=${WK_CLIENT_SECRET}
       - WK_REDIRECT_URL=https://auth.example.com/callback
     restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/health"]
-      interval: 30s
-      timeout: 3s
-      retries: 3
 ```
 
+The runtime image is distroless and has no shell utilities such as `wget`; configure Kubernetes/OCI HTTP probes against `/health` instead of a container-local shell healthcheck.
+
 ### Reverse Proxy (nginx)
 
 ```nginx

auth-server/dockerfile_test.go

@@ -13,7 +13,7 @@ func TestDockerfileDocumentsEnterpriseM365EnvContract(t *testing.T) {
 	}
 
 	content := string(data)
-	for _, want := range []string{"WK_PUBLIC_BASE_URL", "WK_M365_CLIENT_ID", "WK_M365_TENANT_ID", "EXPOSE 8080", "workit-auth-server"} {
+	for _, want := range []string{"WK_PUBLIC_BASE_URL", "WK_M365_CLIENT_ID", "WK_M365_TENANT_ID", "TARGETARCH", "EXPOSE 8080", "workit-auth-server"} {
 		if !strings.Contains(content, want) {
 			t.Fatalf("Dockerfile missing %s", want)
 		}

auth-server/m365.go

@@ -66,6 +66,13 @@ func (s *m365SessionStore) save(session m365Session) {
 		s.sessions = make(map[string]m365Session)
 	}
 
+	now := time.Now()
+	for state, existing := range s.sessions {
+		if !existing.ExpiresAt.IsZero() && now.After(existing.ExpiresAt) {
+			delete(s.sessions, state)
+		}
+	}
+
 	s.sessions[session.State] = session
 }
 
@@ -142,6 +149,7 @@ func (s *Server) handleM365Sessions(w http.ResponseWriter, r *http.Request) {
 		ExpectedEmail string `json:"expected_email"`
 		ForceConsent  bool   `json:"force_consent"`
 	}
+	r.Body = http.MaxBytesReader(w, r.Body, 4096)
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeJSONError(w, http.StatusBadRequest, err)
 		return
@@ -180,7 +188,7 @@ func (s *Server) handleM365Start(w http.ResponseWriter, r *http.Request) {
 	state := strings.TrimPrefix(r.URL.Path, "/m365/start/")
 	session, err := s.m365Sessions.get(state)
 	if err != nil {
-		writeJSONError(w, http.StatusNotFound, err)
+		s.renderErrorPage(w, "Microsoft 365 login link expired or not found", http.StatusNotFound)
 		return
 	}
 
@@ -283,7 +291,7 @@ func (s *Server) m365OAuthConfig(redirectURL string) oauth2.Config {
 
 	return oauth2.Config{
 		ClientID:    s.m365ClientID,
-		Endpoint:    oauth2.Endpoint{AuthURL: base + "/authorize", TokenURL: base + "/token"},
+		Endpoint:    oauth2.Endpoint{AuthURL: base + "/authorize", TokenURL: base + "/token", AuthStyle: oauth2.AuthStyleInParams},
 		RedirectURL: redirectURL,
 		Scopes:      []string{"offline_access", "User.Read", "Mail.Read", "Calendars.Read"},
 	}
@@ -381,7 +389,7 @@ func validateM365Email(expected string, actual string) error {
 	want := strings.ToLower(strings.TrimSpace(expected))
 	got := strings.ToLower(strings.TrimSpace(actual))
 	if want == "" || got == "" || want != got {
-		return fmt.Errorf("%w: expected %s got %s", errM365EmailMismatch, want, got)
+		return fmt.Errorf("%w: email mismatch", errM365EmailMismatch)
 	}
 
 	return nil

auth-server/m365_handlers_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestM365SessionsCreatesEnterpriseOneClickURL(t *testing.T) {
@@ -89,6 +90,53 @@ func TestM365StartRedirectsToMicrosoftAuthorize(t *testing.T) {
 	}
 }
 
+func TestM365StartUnknownStateRendersHTML(t *testing.T) {
+	server := NewServerWithOptions(ServerOptions{
+		Store:              NewTokenStore(DefaultTTL),
+		GoogleClientID:     "google-client",
+		GoogleClientSecret: "google-secret",
+		GoogleRedirectURL:  "https://auth.hv.example/callback",
+		M365Enabled:        true,
+		M365ClientID:       "m365-client",
+		M365TenantID:       "hapvida-tenant",
+		PublicBaseURL:      "https://auth.hv.example",
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/m365/start/missing", nil)
+	rec := httptest.NewRecorder()
+	server.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Type"), "text/html") {
+		t.Fatalf("content-type = %q", rec.Header().Get("Content-Type"))
+	}
+}
+
+func TestValidateM365EmailDoesNotExposePII(t *testing.T) {
+	err := validateM365Email("bernardo@hapvida.com.br", "other@hapvida.com.br")
+	if err == nil {
+		t.Fatal("expected mismatch")
+	}
+	if strings.Contains(err.Error(), "bernardo") || strings.Contains(err.Error(), "other") {
+		t.Fatalf("PII leaked in error: %v", err)
+	}
+}
+
+func TestM365SessionStorePrunesExpiredOnSave(t *testing.T) {
+	store := newM365SessionStore()
+	store.save(m365Session{State: "expired", ExpectedEmail: "pilot@example.com", ExpiresAt: time.Now().Add(-time.Minute)})
+	store.save(m365Session{State: "fresh", ExpectedEmail: "pilot@example.com", ExpiresAt: time.Now().Add(time.Minute)})
+
+	if _, err := store.get("expired"); err == nil {
+		t.Fatal("expected expired session to be pruned")
+	}
+	if _, err := store.get("fresh"); err != nil {
+		t.Fatalf("fresh session: %v", err)
+	}
+}
+
 func TestM365SessionsFailClosedWhenServerConfigMissing(t *testing.T) {
 	server := NewServerWithOptions(ServerOptions{
 		Store:              NewTokenStore(DefaultTTL),

auth-server/main.go

@@ -80,11 +80,6 @@ func main() {
 		log.Fatal("Public base URL is required for M365 broker (--public-base-url, WK_PUBLIC_BASE_URL, or WK_CALLBACK_SERVER)")
 	}
 
-	// Default redirect URL if not specified
-	if *redirectURL == "" {
-		*redirectURL = fmt.Sprintf("http://localhost:%d/callback", *port)
-	}
-
 	// Create token store with TTL and start cleanup
 	store := NewTokenStore(*ttl)
 	store.StartCleanup(CleanupInterval)

internal/cmd/auth_m365_link.go

@@ -48,6 +48,10 @@ func (c *AuthM365LoginLinkCmd) resolveBrokerURLs() (string, string, error) {
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
 		return "", "", usage("invalid m365 broker --base-url")
 	}
+	parsedCallback, err := url.Parse(callbackURL)
+	if err != nil || parsedCallback.Scheme == "" || parsedCallback.Host == "" {
+		return "", "", usage("invalid m365 broker --callback-url")
+	}
 
 	return baseURL, callbackURL, nil
 }

internal/cmd/m365_login_link_test.go

@@ -74,3 +74,15 @@ func TestAuthM365LoginLinkUsesCallbackServerDefaultWhenURLsOmitted(t *testing.T)
 		t.Fatalf("callback url = %q", got.CallbackURL)
 	}
 }
+
+func TestAuthM365LoginLinkRejectsInvalidCallbackURL(t *testing.T) {
+	_ = captureStderr(t, func() {
+		err := Execute([]string{"auth", "m365", "login-link", "bernardo@hapvida.com.br", "--base-url", "https://auth.hv.example", "--callback-url", "not-a-url"})
+		if err == nil {
+			t.Fatal("expected invalid callback URL failure")
+		}
+		if !strings.Contains(err.Error(), "callback-url") {
+			t.Fatalf("unexpected error: %v", err)
+		}
+	})
+}