fix(auth): close encoded-backslash open-redirect + tidy callback findings

Address the latest Copilot review on PR #39:

- sanitizeRelativePath: reject a backslash in the decoded path. A
  percent-encoded backslash ("/%5cevil.com") survived the literal "/\\"
  prefix check, and user agents that normalize "\" to "/" would read the
  decoded "//evil.com" as a protocol-relative redirect.
- Callback: return 400 (not 502) on nonce mismatch — a client/session
  issue or attack, not an upstream failure, mirroring the state path.
- Fix the package comment: the flow now carries four flow cookies
  (state/verifier/nonce/returnUrl), not three.
- Pin the bypass with percent-encoded backslash test cases.

Claude-Session: https://claude.ai/code/session_01M4Dd5oASBGHwr6ts6wTnYn

Author: AYDEV-FR

internal/auth/oidc.go

@@ -5,7 +5,7 @@
 // the canonical Go OIDC pattern used by Kubernetes, Argo CD and the official
 // coreos/go-oidc README example: go-oidc for discovery + ID token
 // verification, golang.org/x/oauth2 for the Authorization Code + PKCE flow,
-// and three short-lived HttpOnly cookies to carry state/verifier/returnUrl
+// and four short-lived HttpOnly cookies to carry state/verifier/nonce/returnUrl
 // across the browser bounce. No framework, no signed-cookie key management,
 // nothing dploy-specific beyond the optional split-horizon issuer support
 // and the SPA's "#token=..." hand-off.
@@ -162,6 +162,13 @@ func sanitizeRelativePath(s string) (string, bool) {
 	if err != nil || u.Scheme != "" || u.Host != "" || u.User != nil {
 		return "", false
 	}
+	// A percent-encoded backslash (e.g. "/%5cevil.com") survives the literal
+	// "/\\" prefix check above but decodes into u.Path; user agents that
+	// normalize "\" to "/" would then read "//evil.com" as protocol-relative.
+	// Reject any backslash in the decoded path to close that bypass.
+	if strings.Contains(u.Path, "\\") {
+		return "", false
+	}
 	u.Fragment = ""
 	return u.String(), true
 }
@@ -293,7 +300,9 @@ func (h *OIDCHandler) Callback(c *fiber.Ctx) error {
 	// token carrying the attacker's nonce, not ours. Constant-time compare
 	// because the nonce stays a one-shot secret until the cookie clears.
 	if subtle.ConstantTimeCompare([]byte(idToken.Nonce), []byte(nonce)) != 1 {
-		return c.Status(fiber.StatusBadGateway).JSON(fiber.Map{"error": "nonce mismatch"})
+		// Client-side/session issue or an attack, not an upstream failure —
+		// mirror the state-mismatch path with a 400 rather than a 502.
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "nonce mismatch"})
 	}
 
 	// Re-sanitize the returnUrl from the cookie as defense-in-depth, even

internal/auth/oidc_test.go

@@ -23,6 +23,9 @@ func TestSanitizeRelativePath(t *testing.T) {
 		// classic open-redirect tricks — all rejected
 		{"//evil.com/x", "", false},       // protocol-relative URL
 		{"/\\evil.com/x", "", false},      // backslash-prefixed (some browsers)
+		{"/%5cevil.com/x", "", false},     // percent-encoded backslash
+		{"/%5Cevil.com/x", "", false},     // percent-encoded backslash (upper)
+		{"/foo/%5cbar", "", false},        // encoded backslash mid-path
 		{"http://evil.com/x", "", false},  // absolute URL
 		{"https://evil.com/x", "", false}, // absolute URL https
 		{"javascript:alert(1)", "", false},