fix(auth): bind OAuth callback listener to loopback only

[SashaMIT]

Anyone on the local network can cancel your ToolHive login while you are signing in.

Problem

The OAuth callback server used during interactive login binds :port (all interfaces) for the whole login flow, while the redirect URL it advertises is http://localhost:<port>/callback:

f.server = &http.Server{
    Addr:              fmt.Sprintf(":%d", f.port),
    Handler:           mux,
    ReadHeaderTimeout: 10 * time.Second,
}

Any host on the LAN can therefore reach the callback endpoint while a login is in progress and:

• observe that a ToolHive login is happening, and
• abort it by requesting /callback?error=access_denied (the error path does not require the state parameter) or by sending a wrong state.

Login-code theft is not possible: the 128-bit random state is validated before any token exchange, so an attacker cannot inject their own authorization code. The impact is an unauthenticated remote denial of service of interactive logins, plus an HTTP surface on every interface that has no reason to be reachable off-host.

Fix

Bind the listener to 127.0.0.1 explicitly via a small listenAddr() helper. This matches the redirect URL's localhost semantics and the loopback address the port-availability probe (networking.IsAvailable) already uses when selecting the callback port.

Tests

Added TestListenAddrLoopback, which asserts the listener address parses to a loopback IP on the flow's callback port. The pkg/auth/oauth, pkg/auth/tokensource, and pkg/auth/discovery suites pass.

Made with Cursor