feat(auth): add generic OIDC login with mandatory groups

backend/src/auth/session-store.ts

@@ -68,6 +68,8 @@ export interface OidcStateCreateInput {
   nonce: string;
   codeVerifier: string;
   returnTo: "/";
+  authConfigRevision: string;
+  issuer: string;
 }
 
 export interface CreatedOidcState {
@@ -188,6 +190,8 @@ const oidcStateRecordSchema = z.strictObject({
   nonce: z.string().min(16).max(512).regex(/^[A-Za-z0-9_-]+$/),
   codeVerifier: z.string().min(43).max(128).regex(/^[A-Za-z0-9._~-]+$/),
   returnTo: z.literal("/"),
+  authConfigRevision: z.string().regex(/^[a-f0-9]{64}$/),
+  issuer: z.string().min(1).max(2048).refine((value) => !/\p{Cc}/u.test(value)),
   createdAt: timestamp,
   expiresAt: timestamp,
 }).superRefine((record, context) => {
@@ -226,6 +230,8 @@ const oidcStateInputSchema = z.strictObject({
   nonce: z.string().min(16).max(512).regex(/^[A-Za-z0-9_-]+$/),
   codeVerifier: z.string().min(43).max(128).regex(/^[A-Za-z0-9._~-]+$/),
   returnTo: z.literal("/"),
+  authConfigRevision: z.string().regex(/^[a-f0-9]{64}$/),
+  issuer: z.string().min(1).max(2048).refine((value) => !/\p{Cc}/u.test(value)),
 });
 
 function sameFileIdentity(left: FileIdentity, right: FileIdentity): boolean {
@@ -927,6 +933,8 @@ export function createFileAuthSessionStore(
       nonce: validated.nonce,
       codeVerifier: validated.codeVerifier,
       returnTo: validated.returnTo,
+      authConfigRevision: validated.authConfigRevision,
+      issuer: validated.issuer,
       createdAt: isoAt(nowMs),
       expiresAt: isoAt(expiresMs),
     };