fix(auth): harden persistent sessions

backend/test/fixtures/oidc-state-consumer.mts

@@ -0,0 +1,19 @@
+import { createFileAuthSessionStore } from "../../src/auth/session-store.js";
+
+const root = process.env.THT_TEST_SESSION_ROOT;
+const state = process.env.THT_TEST_OIDC_STATE;
+
+if (!root || !state || !process.send) process.exit(2);
+
+process.send("ready");
+process.once("message", async (message) => {
+  if (message !== "consume") process.exit(3);
+  try {
+    const record = await createFileAuthSessionStore(root).consumeOidcState(state);
+    process.send?.({ consumed: record !== undefined });
+    process.exit(0);
+  } catch {
+    process.send?.({ consumed: false, failed: true });
+    process.exit(1);
+  }
+});