feat: run local development against a mock identity provider

[turegjorup]

Link to ticket

TODO: no ticket linked yet — please add before review.

Description

Local development ran with the main firewall switched off:

# Current AAK OIDC setup doesn't support `itksites.local.itkdev.dk`
when@dev:
    security:
        firewalls:
            main:
                security: false

The reason was real — AAK's provider has no redirect URI registered for a developer machine — but the shape of the workaround is the problem. No OpenID Connect code path is exercised until the code reaches a server, so a broken callback path, a renamed claim or a login loop all stay invisible locally. And because it is a single line in a when@dev block, it is easy to forget: an authentication problem can be debugged for a long while against a firewall that was never running. That is roughly what happened to me while validating #92 — several wrong turns before noticing security was off.

This replaces it with a mock provider, so the whole authorization code flow runs locally.

• idp service in docker-compose.override.yml, so it never starts on a server. oidc-provider-mock, the same one deltag.aarhus.dk uses.
• when@dev firewall bypass removed.
• .env.dev carries the mock settings, so an ordinary setup needs nothing in .env.local.
• README section rewritten.

Two identities, admin and editor. Their claims include name and upn because that is what AzureOIDCAuthenticator reads — a mock without those fails at the array access rather than at anything informative.

The container name is the external hostname on purpose (idp.${COMPOSE_DOMAIN}). The browser and the application then reach the provider by the same name, so the issuer in the discovery document matches the one in the ID token. Getting this wrong gives an issuer mismatch that reads like a bundle bug.

Verified

Run against this branch:

Check	Result
Discovery reachable from phpfpm by the external hostname	endpoints returned on idp.itksites.local.itkdev.dk
/admin anonymous	302 → /openidconnect/login/azure_az — the firewall challenges again
Login route	302 → the mock, scope=openid email profile, correct redirect_uri, state stored
allow_http	discovery fetched over http inside the network

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

No new test cases: this changes the development environment only. The existing suite is unaffected — test already had security enabled and its own .env.test.

Additional comments or questions

Existing developers must prune .env.local. Dotenv loads .env → .env.dev → .env.local, so real Azure values already in .env.local still win and the mock will not be used. Remove the AZURE_AZ_OIDC_* lines from it, or keep them deliberately to develop against the real provider.

AZURE_AZ_OIDC_ALLOW_HTTP=true is in .env.dev and must not spread. From itk-dev/openid-connect 5.1 it governs every endpoint the discovery document announces, not just the metadata URL, so it is a wider switch than it used to be. .env keeps false, and the README says so.

The mock does not verify PKCE. It accepts the challenge and the verifier, so a login completes, but it omits code_challenge_methods_supported from its discovery document. Once the bundle sends PKCE by default (6.1), a green local login will not be evidence that PKCE works against Azure. The README says this.

Relationship to #92. Independent — that one is the 6.0 upgrade, this is the development environment — so either can merge first. Raised as its own PR rather than added to #92, which is large enough.

[github-actions]

API Specification - Non-breaking changes

No changelog changes

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.55%. Comparing base (bae8493) to head (14385a7).
⚠️ Report is 51 commits behind head on develop.

Additional details and impacted files

@@              Coverage Diff              @@
##             develop      #97      +/-   ##
=============================================
+ Coverage      37.14%   37.55%   +0.40%     
- Complexity       948     1104     +156     
=============================================
  Files            133      146      +13     
  Lines           2972     3499     +527     
=============================================
+ Hits            1104     1314     +210     
- Misses          1868     2185     +317     

Flag	Coverage Δ
unittests	37.55% <ø> (+0.40%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.