feat(sso): OIDC authorize + callback + linking handlers (V2-272 chunk B)

[Nic-dorman]

Summary

Second of four PRs for V2-272. Mounts the OIDC service from chunk A on the router and adds the public auth + authenticated linking endpoints.

Stacked on #31 — base is nic/v2-272-sso-foundation. Merge chunk A first.

Routes added

Public (unauthenticated)

Method	Path	Purpose
GET	/api/v2/auth/oidc/providers	List enabled providers as {id, name, display_name}. Deliberately omits client_id and the encrypted secret.
GET	/api/v2/auth/oidc/authorize/{providerId}	Sets the encrypted state cookie (HttpOnly + Secure + SameSite=Lax + scoped Path=/api/v2/auth/oidc) and 302's to the IdP.
GET	/api/v2/auth/oidc/callback	Clears the state cookie up-front, calls HandleCallback, issues a session JWT via the same path Login uses, 302's to / on success or /login?error=<code> on failure. IdP-side errors (?error=access_denied etc.) pass through.

Authenticated

Method	Path	Purpose
POST	/api/v2/auth/oidc/link/{providerId}	Same flow as authorize but with LinkToUserID set. Returns {authorize_url} as JSON so the frontend can do window.location.href (POST→302 doesn't play nicely with fetch).
DELETE	/api/v2/auth/oidc/identities/{identityId}	Calls UnlinkIdentity. 409 + last_login_method code when it would leave the user with no way to log in.
GET	/api/v2/me/oidc/identities	Returns the user's identities with provider_name resolved for the profile "connected accounts" view.

Admin

Method	Path	Purpose
PUT	/api/v2/admin/oidc/providers/{id}/auto-provision	{auto_provision, default_group_id}. Separate from the main Update endpoint so the UI toggle (chunk C) can flip it without re-supplying every other field. default_group_id=0 clears the group assignment.

Error code mapping (/login?error=...)

Sentinel	Code
ErrOIDCNoAccount	no_account
ErrOIDCEmailCollision	email_exists
state / nonce / cookie variants	session_expired
ErrOIDCMissingEmail	missing_email
ErrOIDCProviderDisabled	provider_disabled
(other)	internal

oidcCallbackURL prefers cfg.BaseURL when set (production), falls back to deriving scheme + host from the incoming request.

Test coverage — 10 in internal/handlers/oidc_auth_test.go

• ListOIDCProviders only shows enabled, doesn't leak client_id
• Authorize sets HttpOnly+Lax cookie, 302's to IdP, URL includes PKCE S256 challenge
• Authorize → 404 for unknown provider
• Full round-trip: authorize → fake IdP /authorize → callback with pre-linked identity → session cookie set, 302 to /
• Callback with auto_provision=off + unknown sub → /login?error=no_account
• Callback with IdP ?error=access_denied → /login?error=access_denied
• Unlink requires auth (401)
• Unlink last-login-method returns 409 with last_login_method code
• /me/oidc/identities lists user's identities with provider_name resolved
• Admin set auto_provision persists

The handler tests reuse a fake IdP (httptest + go-jose RS256 JWKS) that auto-redirects /authorize back to the callback with code+state, so the full authorize → IdP → callback chain runs in-process. Chunk D adds Dex on top for browser-driven verification.

Test plan

• go test ./internal/services/ ./internal/handlers/ ./internal/worker/ — all green
• go build ./... clean
• CI Postgres matrix green

Next

• Chunk C — LoginView.vue SSO button, profile connected-accounts section, admin auto-provision UI in SettingsView.vue
• Chunk D — Dex CI service container + Playwright E2E

🤖 Generated with Claude Code