[mariusmm]

Working PR (draft). Step 1 of 5 for #425. It does not close #425 and should not be merged as the resolution.

What this PR does

Adds the regression baseline that must stay green across the openidconnect upgrade needed for RUSTSEC-2026-0387:

• The mock OIDC provider is parameterised over RS256, ES256 and ES384.
• For each algorithm, three tests:
  • a correctly signed ID token is accepted with the expected identity;
  • a token signed by a key the JWKS does not publish is rejected;
  • a token whose claims changed after signing is rejected.
• Why: the existing tests only asserted one rejection (valid signature, wrong nonce). There was no accept-path test, and ES256/ES384, the algorithms verified through p256/p384, had no coverage.
• Dev-dependencies: p256 and p384 0.13, already in the tree (lockfile gains two lines).

No production code changes.

Verification (on openidconnect 4.0.1)

• cargo test -p marreq-core --lib auth::provider: 10 passed
• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings: pass
• cargo deny check advisories: ok (still relies on the stopgap ignore from fix(deps): clear cargo-deny and npm audit advisories blocking CI #426)

Plan for #425 and status (Route A: wait for the upstream release)

Upstream ramosbugs/openidconnect-rs main already has "Bump p256 and p384 to fix RUSTSEC-2026-0387" (crate version 4.1.0, MSRV 1.88), but the latest published release is still 4.0.1. elliptic-curve 0.14 requires crypto-bigint ^0.7.8, which satisfies the advisory.

Step	Status
1. Add ES256/ES384 + accept-path regression tests on current main	This PR
2. Upgrade openidconnect to 4.1.0 once released; bump the p256/p384 dev-deps to 0.14 with it; check oauth2 5.0.0 compatibility; fix any API changes in marreq-core/src/auth/provider.rs; confirm cargo tree -i crypto-bigint@0.5.5 is empty	Pending, blocked on the upstream release
3. Remove the RUSTSEC-2026-0387 ignore from deny.toml	Pending, after step 2
4. Verify against the acceptance criteria: cargo deny check advisories without the ignore; clippy, fmt and the Rust workspace tests; delegated_oauth_postgres_integration and auth_public_integration_test; these tests unchanged and green; a before/after list of supported signing algorithms for explicit review; a manual login against a real provider if one is available	Pending
5. Open the upgrade PR with Closes #425 and the before/after algorithm list	Pending

Steps 2 to 5 are not started. The upstream release date is unknown, and nothing has been asked of the upstream project.

Merge guidance

This PR is safe to merge on its own, because it only adds tests, so it can land before the upgrade. Until then, #425 stays open and the deny.toml ignore stays in place.

Refs #425

🤖 Generated with Claude Code

[github-actions]

Frontend SPA coverage (by module)

Module	Line Rate	Branch Rate	Function Rate	Health
api	89.1% (311 / 349)	82.7%	86.0%	✔
components	74.1% (2234 / 3015)	62.6%	70.5%	➖
components/graph	100.0% (9 / 9)	66.7%	100.0%	✔
components/reports	86.1% (87 / 101)	70.6%	74.1%	✔
components/table	100.0% (7 / 7)	80.0%	100.0%	✔
context	77.8% (56 / 72)	40.0%	69.6%	➖
hooks	72.3% (146 / 202)	71.1%	70.0%	➖
lib	100.0% (18 / 18)	100.0%	100.0%	✔
pages	68.7% (2331 / 3392)	55.5%	61.0%	➖
pages/catalog	34.8% (162 / 465)	24.5%	18.3%	❌
pages/groups	0.0% (0 / 219)	0.0%	0.0%	❌
src (root)	33.3% (8 / 24)	38.1%	60.0%	❌
types	100.0% (0 / 0)	100.0%	100.0%	✔
utils	97.2% (620 / 638)	89.1%	98.8%	✔
Summary	70.4% (5989 / 8511)	59.1%	65.1%	➖

Generated from Vitest @vitest/coverage-v8 (frontend/src).