feat(auth): validate mapped groups through Authentik

backend/test/oidc-client.test.ts

@@ -1,6 +1,6 @@
 import { createSign, generateKeyPairSync } from "node:crypto";
 import { expect, test } from "vitest";
-import { createOidcProtocol, OidcProtocolError, OidcProviderUnavailableError } from "../src/auth/oidc-client.js";
+import { createOidcProtocol, OidcJwksUnavailableError, OidcProtocolError, OidcProviderUnavailableError } from "../src/auth/oidc-client.js";
 
 const issuer = "https://issuer.example.test";
 const clientId = "thothii";
@@ -362,6 +362,12 @@ test("aborts a hanging JWKS request at the configured timeout", async () => {
   expect(aborted).toBe(true);
 });
 
+test("diagnose validates the bounded JWKS endpoint after discovery", async () => {
+  const subject = protocol({ jwksResponse: () => new Response("upstream JWKS body", { status: 503 }) });
+
+  await expect(subject.diagnose(new AbortController().signal)).rejects.toBeInstanceOf(OidcJwksUnavailableError);
+});
+
 test("rejects an oversized JWKS Content-Length before reading the body", async () => {
   let pulls = 0;
   let cancelled = false;