Add OIDC middleware

[meher745]

This PR introduces comprehensive OpenID Connect (OIDC) support into the GoFr framework by adding:

OIDC Discovery Metadata Fetching & Caching (discovery.go)
Implements dynamic fetching and caching of OIDC provider metadata (including issuer, JWKS URI, and userinfo endpoint) from the standard .well-known/openid-configuration URL.

OIDC Userinfo Middleware (oidc.go)
Middleware to fetch user profile information from the OIDC userinfo endpoint after OAuth JWT token validation. This middleware injects the retrieved user info into the request context for downstream handlers to use.

Dedicated Tests (oidc_test.go, discovery_test.go)
Thorough test coverage for both userinfo middleware and discovery metadata fetching utilities, covering success scenarios, error handling, caching behavior, and edge cases.

Documentation (docs/advanced-guide/oidc.md)
Detailed usage guide explaining how to configure and use the new OIDC features alongside GoFr’s built-in OAuth middleware. Includes examples for discovery, middleware registration, and handler access to user info.

Implementation Highlights

1. discovery.go:

• Fetches OIDC metadata from the provider’s discovery URL.
• Caches metadata with configurable expiration to minimize network calls.

2. oidc.go:

• Middleware extracts the validated Bearer token (via Authorization header).
• Calls the provider’s userinfo endpoint with the token and parses JSON user details.
• Injects user info into the Go standard context.Context, retrievable by the helper GetOIDCUserInfo.

Usage Flow:

• Fetch discovery metadata at app startup.
• Pass discovered JWKS URI and issuer to app.EnableOAuth.
• Register the OIDC userinfo middleware after OAuth.
• Access user profile info in route handlers via context helper.

Testing

All new tests pass:

• oidc_test.go covers userinfo middleware success, token absence, userinfo endpoint failures, and JSON parsing errors.
• discovery_test.go covers metadata fetching success, caching, HTTP errors, JSON errors, and network failures.

Existing package tests:

• All existing and new OIDC-related tests pass locally.
• There is one unrelated failing legacy test (TestGetJwtClaims) from the GoFr core package that does NOT concern this PR and does not affect the OIDC middleware functionality.

Thanks for considering this contribution!

[meher745]

Hi, @Umang01-hash @coolwednesday . Please review this PR. Thank you so much!

[ccoVeille]

And http.Get without passing a contexf doesn't sound a good idea

[meher745]

Hi @ccoVeille @Umang01-hash @coolwednesday . I've updated the files according to the recommendations. Please review.

[ccoVeille]

Sound good to me, a minor remark

[ccoVeille]

Why this change?

[meher745]

Hi, this change was not intentional. It seems it got included in my PR because I accidentally staged all changes using git add . while preparing my commit. Please let me know if you’d like me to remove it. @ccoVeille

[Umang01-hash]

@meher745 Please revert back this change.

[meher745]

@ccoVeille , kindly merge the pull request. Thanks!

[ccoVeille]

I'm an active code reviewer of gofr. But I'm not a maintainer. I cannot merge.

Let's wait for a maintainer feedback

@coolwednesday @Umang01-hash

[akshat-kumar-singhal]

@meher745 There's a lot of redundancy in your code right now - consider using the existing Auth Middleware which accepts AuthProvider.
cc @Umang01-hash @coolwednesday

[Umang01-hash]

@meher745 Here are a few review suggestions for your PR:

• Instead of using dynamic errors (fmt.Errorf()) please use predefined errors.
• For the documentation i see we can improve on how we are portraying this feature to user, the code included should be well formatted, include proper spaces and comments. Remove repeteted things and big technical jagrons let's try to keep it simple so that evry user can understand it. Also the documentation file is directly placed under docs/advanced-guide which is not correct. We need to follow the exact same way other documentations are following.
• Please resolve all the linter and code quality errors in your code.

[Umang01-hash]

@meher745 Please revert back this change.

[Umang01-hash]

To integrate OIDC with the existing AuthProvider based AuthMiddleware, you can implement a new OIDCAuthProvider struct in oidc.go that satisfies the AuthProvider interface. This allows you to reuse the unified authentication flow for OIDC, just like Basic, API key, and OAuth. Simply extract (& validate if needed) the Bearer token in ExtractAuthHeader, and return user info or claims as needed. Then, pass your provider to AuthMiddleware for consistent middleware usage.

[Umang01-hash]

@meher745 Are you still working in this PR?

[meher745]

@meher745 Are you still working in this PR?

Yes I am. I am almost done with the desired changes.