Fix critical DPoP nonce bypass and security issues

[Cache8063]

Summary

• Fix DPoP nonce bypass in DPoPNonceMiddleware — the middleware was validating its own response header instead of the client's DPoP JWT nonce, meaning nonce validation always passed regardless of what the client sent
• Add missing error checks after GetOauthClient() in Return() and getOAuthSession() where errors were silently overwritten by the next := assignment
• Remove access token from error log in Return() to prevent credential leakage in log output
• Remove debug print statements (fmt.Println / fmt.Printf) that leaked session data to stdout

Ref: #7

Details

DPoP Nonce Bypass (Critical)

In DPoPNonceMiddleware, the code was:

validNonces := generateValidNonces(...)
c.Response().Header().Set("DPoP-Nonce", validNonces[0])  // set on response
dpopNonce := c.Response().Header().Get("DPoP-Nonce")      // read back own value
if !slices.Contains(validNonces, dpopNonce) { ... }        // always passes

Fixed to validate the nonce from the client's DPoP JWT claims (dpopClaims.Nonce), matching the correct pattern already used in OAuthMiddleware.

Unchecked Errors

GetOauthClient() returns (*Client, error) but the error was being silently overwritten:

oclient, err := o.GetOauthClient()
jkt, _, err := parseState(state)  // overwrites err

Added proper error checks before proceeding.

Test plan

• go build ./... passes
• go vet ./... passes
• go test ./... passes
• Manual verification of DPoP nonce flow with a real client

🤖 Generated with Claude Code