[shardool-patil]

Motivation

Resolves an existing TODO in getCallbackState where decryption failures on OIDC state parameters were unmonitored. Emitting metrics on invalid state tokens improves observability and alerts operators to potential token tampering, malformed callback requests, or replay attempts.

Summary

• Export metric counter key oidcInvalidTokenMetric = "oidc.token.invalid".
• Instrument getCallbackState in filters/auth/oidc.go to increment oidc.token.invalid via ctx.Metrics().IncCounter() when state decryption fails.
• Add deterministic, table-driven test cases (TestGetCallbackState_InvalidStateTokenMetric) in filters/auth/oidc_test.go using metricstest.MockMetrics to verify:
  • Valid state parameters do not increment the counter.
  • Missing state query parameter fails without incrementing the decryption error counter.
  • Malformed hex encoding fails without incrementing the counter.
  • Corrupted/tampered state ciphertext triggers decryption failure and increments oidc.token.invalid.

[szuecs]

@shardool-patil can you add the metric to docs/operations/operation.md ? Thanks, rest lgtm

[shardool-patil]

@shardool-patil can you add the metric to docs/operations/operation.md ? Thanks, rest lgtm

done added the required docs