auth-providers: OIDC callback hardening (3 commits) - #10931

Open

MichaelUray wants to merge 8 commits into

hcengineering:developfrom

MichaelUray:feat/oidc-hardening

Commits on Sep 6, 2026

fix(authProviders): instrument OIDC callback + redirect on fail (not 500)
MichaelUray
committed
63c64b0
fix(account): admin.ts trim+lowercase on both env-set AND lookup
MichaelUray
committed
ebdaa40
chore(authProviders): drop cookieHeaderLen from OIDC diagnostics (E4 amendment)
MichaelUray
committed
7aaff27
auth(oidc): gate verbose callback diagnostics behind OIDC_DEBUG (L-AUTH-2)
MichaelUray
committed
bda335d
account(admin): drop non-email ADMIN_EMAILS entries unless explicitly allowed (L-AUTH-3)
MichaelUray
committed
90bb1c7
auth(oidc): redirect to /login when provider auth yields no account (L-AUTH-4)
MichaelUray
committed
6f6d05e
test(account): use example.com fixtures in adminEmails tests
MichaelUray
committed
d05f4f9
auth(oidc): retry strategy registration with capped backoff (L-AUTH-5)
MichaelUray
committed
514bdc5