fix(oidc): use authenticated encryption for opaque tokens (#12017)

# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>

internal/api/grpc/oidc/v2/oidc.go

@@ -2,7 +2,6 @@ package oidc
 
 import (
 	"context"
-	"encoding/base64"
 
 	"connectrpc.com/connect"
 	"github.com/zitadel/logging"
@@ -46,13 +45,13 @@ func (s *Server) GetDeviceAuthorizationRequest(ctx context.Context, req *connect
 	if err != nil {
 		return nil, err
 	}
-	encrypted, err := s.encryption.Encrypt([]byte(deviceRequest.DeviceCode))
+	encrypted, err := s.authAlg.EncryptToken(deviceRequest.DeviceCode)
 	if err != nil {
 		return nil, err
 	}
 	return connect.NewResponse(&oidc_pb.GetDeviceAuthorizationRequestResponse{
 		DeviceAuthorizationRequest: &oidc_pb.DeviceAuthorizationRequest{
-			Id:          base64.RawURLEncoding.EncodeToString(encrypted),
+			Id:          encrypted,
 			ClientId:    deviceRequest.ClientID,
 			Scope:       deviceRequest.Scopes,
 			AppName:     deviceRequest.AppName,
@@ -62,7 +61,7 @@ func (s *Server) GetDeviceAuthorizationRequest(ctx context.Context, req *connect
 }
 
 func (s *Server) AuthorizeOrDenyDeviceAuthorization(ctx context.Context, req *connect.Request[oidc_pb.AuthorizeOrDenyDeviceAuthorizationRequest]) (*connect.Response[oidc_pb.AuthorizeOrDenyDeviceAuthorizationResponse], error) {
-	deviceCode, err := s.deviceCodeFromID(req.Msg.GetDeviceAuthorizationId())
+	deviceCode, err := s.authAlg.DecryptToken(req.Msg.GetDeviceAuthorizationId())
 	if err != nil {
 		return nil, err
 	}
@@ -258,11 +257,3 @@ func errorReasonToOIDC(reason oidc_pb.ErrorReason) string {
 		return "server_error"
 	}
 }
-
-func (s *Server) deviceCodeFromID(deviceAuthID string) (string, error) {
-	decoded, err := base64.RawURLEncoding.DecodeString(deviceAuthID)
-	if err != nil {
-		return "", err
-	}
-	return s.encryption.DecryptString(decoded, s.encryption.EncryptionKeyID())
-}

internal/api/grpc/oidc/v2/server.go

@@ -24,7 +24,7 @@ type Server struct {
 
 	op             *oidc.Server
 	externalSecure bool
-	encryption     crypto.EncryptionAlgorithm
+	authAlg        crypto.AuthAlgorithm
 }
 
 type Config struct{}
@@ -34,14 +34,14 @@ func CreateServer(
 	query *query.Queries,
 	op *oidc.Server,
 	externalSecure bool,
-	encryption crypto.EncryptionAlgorithm,
+	authAlg crypto.AuthAlgorithm,
 ) *Server {
 	return &Server{
 		command:        command,
 		query:          query,
 		op:             op,
 		externalSecure: externalSecure,
-		encryption:     encryption,
+		authAlg:        authAlg,
 	}
 }