fix(auth): pin native auth storage operations

backend/src/app.ts

@@ -13,9 +13,11 @@ import type { PrincipalContext } from "./auth/principal.js";
 import type { LoadedAuthConfig } from "./auth/types.js";
 import { createCurrentLocalUserRegistryResolver, type LocalUserRegistry } from "./auth/local-registry.js";
 import { AuthSessionOperationalError, createFileAuthSessionStore, type AuthSessionStore, type AuthSessionValidity } from "./auth/session-store.js";
+import type { WindowsAuthStorageBridge } from "./auth/windows-auth-storage.js";
 import { registerAuthRoutes } from "./auth/routes.js";
-import { createOidcProtocol, type OidcProtocol } from "./auth/oidc-client.js";
+import { createOidcProtocol, type OidcProtocol, type OidcProtocolOptions } from "./auth/oidc-client.js";
 import { isUsableAuthenticationSecret } from "./auth/secret-policy.js";
+import { secretValue } from "./config/secret-bundle.js";
 import { sessionRoutes } from "./routes/sessions.js";
 import { sqlRoutes } from "./routes/sql.js";
 import { metaRoutes, type ListModelsFn } from "./routes/meta.js";
@@ -50,7 +52,11 @@ export interface BuildAppDeps {
   piManagement?: PiManagementService;
   localUserRegistry?: LocalUserRegistry;
   authSessionStore?: AuthSessionStore;
+  /** Explicit test-only transport seam; production always invokes the hidden tht bridge. */
+  authStorageBridgeForTest?: WindowsAuthStorageBridge;
   oidcProtocol?: OidcProtocol;
+  /** Explicit test seam; production uses the provider-neutral OIDC constructor. */
+  oidcProtocolFactory?: (options: OidcProtocolOptions) => OidcProtocol;
 }
 
 export interface AppWithAuthSessionStore extends FastifyInstance {
@@ -198,12 +204,10 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   const resolveOidcProtocol = (loaded: LoadedAuthConfig): OidcProtocol | undefined => {
     if (deps?.oidcProtocol) return deps.oidcProtocol;
     if (loaded.value.mode !== "oidc") return undefined;
-    const clientSecret = process.env.THT_OIDC_CLIENT_SECRET;
-    if (!isUsableAuthenticationSecret("THT_OIDC_CLIENT_SECRET", clientSecret)) {
-      return undefined;
-    }
     try {
-      return createOidcProtocol({
+      const clientSecret = secretValue(config, loaded.value.oidc.clientSecretRef);
+      if (!isUsableAuthenticationSecret("THT_OIDC_CLIENT_SECRET", clientSecret)) return undefined;
+      return (deps?.oidcProtocolFactory ?? createOidcProtocol)({
         issuer: loaded.value.oidc.issuer,
         clientId: loaded.value.oidc.clientId,
         clientSecret,
@@ -234,7 +238,11 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
           throw new AuthSessionOperationalError();
         }
       },
-    })
+    }, deps?.authStorageBridgeForTest === undefined
+      ? undefined
+      : process.platform === "win32"
+        ? { windowsStorageBridge: deps.authStorageBridgeForTest }
+        : { posixStorageBridge: deps.authStorageBridgeForTest })
     : undefined);
   (app as AppWithAuthSessionStore).thothiiAuthSessionStore = authSessionStore;
   const authenticate = authenticateSession({