#829 auth: lift OIDC into reusable pkg/auth provider package Pull request opened by alvarofraguas Summary • Introduces

pkg/auth/

with a shared

auth.Provider

interface (

Type()

,

LoginURL()

,

HandleCallback()

) and JWT-based state/nonce cookie helpers • Extracts

pkg/auth/oidc/

from the legacy admin's inline OIDC handling into a reusable provider implementation • Refactors

cmd/admin/handlers/

to consume the shared package — legacy admin OIDC behavior preserved end-to-end •

pickUsername()

reads arbitrary claim names from the raw ID token (fixes Auth0

nickname

claim handling) Depends on • #826 (merged) Test plan • Legacy admin OIDC login still works against Keycloak • Legacy admin OIDC login still works against Auth0 •

go test ./pkg/auth/... ./pkg/users/...

passes •

go vet ./...

clean jmpsec/osctrl