feat: add OAuth2/OIDC with PKCE for SSO login

Add opt-in SSO authentication alongside Basic Auth. OAuth endpoints are auto-discovered via .well-known, with support for external IdPs (Keycloak, Authentik) via configurable OAUTH_ISSUER_URL. Sessions persist through httpOnly refresh token cookies with automatic renewal.
2026-02-25 23:41:37 +01:00
parent 110dd98ad4
commit ec06b0c494
20 changed files with 857 additions and 92 deletions
@@ -0,0 +1,2 @@
+export const OAUTH_SCOPES = 'openid email profile';
+export const REFRESH_TOKEN_COOKIE = 'jmap_rt';