Sign in through an OpenID Connect provider, and from a terminal

terdut can now sign people in through any OIDC provider (written against
Authentik), and let groups at the provider decide who may sign in, which
teams they belong to and whether they administer the install. Password
login keeps working alongside it; TERDUT_PASSWORD_LOGIN=false turns it off,
and is refused at startup unless SSO is configured. With no TERDUT_OIDC_*
setting nothing changes, so every existing install behaves as before.

Identity is (issuer, subject), never email or username: those are mutable
at the provider and a recycled address must not inherit an account. An
existing user is linked by email only when the provider marks it verified,
or TERDUT_OIDC_TRUST_EMAIL is set, which Authentik needs.

Group grants are marked source='oidc' on team_members and users, and the
sync changes only those rows. Hand-made memberships and administrators
are left alone, and the sync bypasses the last-owner and last-admin guards
because the provider is the source of truth for what it grants. Editing
managed access by hand is refused with 409, since the next sign-in would
undo it. The web UI badges it as SSO and disables the controls.

Groups are read only at sign-in, so an SSO session carries a hard ceiling
(sessions.max_expires_at, 12h by default) that sliding never extends.
There is no refresh token, which means API keys of somebody removed at the
provider stay valid until an administrator disables the user. That is
accepted and documented, not fixed.

A client with no browser, the TUI over SSH, signs in with a device code
run by terdut itself (POST /api/oidc/device and /device/token), so the
terminal never talks to the provider and ends up with the ordinary
terdut_session cookie. Only a browser session can approve a code; an API
key cannot. /device?code= sends a signed-out visitor through sign-in and
back, which is what oidc_logins.next is for.

oauth2 is pinned to v0.36.0: v0.37 needs Go 1.26 and the Dockerfile
builds on 1.25.

Migrations 011 and 012 add tables and defaulted columns only.

internal/api/router.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 
 	"git.ryuvia.com/niklas/terdut-server/internal/config"
+	"git.ryuvia.com/niklas/terdut-server/internal/oidc"
 	"git.ryuvia.com/niklas/terdut-server/internal/web"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -20,6 +21,7 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler
 	// two would let a burst of sign-ups lock somebody out of logging in.
 	loginLimit := newLoginLimiter()
 	signupLimiter := newLoginLimiter()
+	oidcLimit := newLoginLimiter()
 
 	r := chi.NewRouter()
 	r.Use(middleware.Logger)
@@ -50,18 +52,43 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config) http.Handler
 	// an invite link is good, so the form can say so before somebody picks a
 	// password.
 	r.Get("/api/signup", handleSignupInfo(db))
-	r.Post("/api/signup", handleSignup(db, signupLimiter, notify.PublicURL))
+	r.With(passwordLoginOnly(!cfg.DisablePasswordLogin)).
+		Post("/api/signup", handleSignup(db, signupLimiter, notify.PublicURL))
+
+	// How to sign in: what the login form and the TUI offer before anybody types.
+	r.Get("/api/auth/config", handleAuthConfig(cfg))
 
 	// Signing in to the web UI. Login trades a password for a session cookie,
 	// which AuthMiddleware accepts in place of an API key.
-	r.Post("/api/login", handleLogin(db, loginLimit, notify.PublicURL))
+	r.With(passwordLoginOnly(!cfg.DisablePasswordLogin)).
+		Post("/api/login", handleLogin(db, loginLimit, notify.PublicURL))
 	r.Post("/api/logout", handleLogout(db, notify.PublicURL))
 
+	// Single sign-on. Both routes are navigations the browser makes, to and from
+	// the provider, so they answer with redirects rather than JSON.
+	if cfg.OIDC.Enabled() {
+		prov := oidc.New(cfg.OIDC, notify.PublicURL)
+		r.Get("/api/oidc/login", handleOIDCLogin(db, prov, oidcLimit, notify.PublicURL))
+		r.Get("/api/oidc/callback", handleOIDCCallback(db, prov, notify.PublicURL))
+
+		// Device login, for a client with no browser of its own. Both are
+		// unauthenticated: the device code in the body is the credential.
+		r.Post("/api/oidc/device", handleDeviceStart(db, oidcLimit, notify.PublicURL))
+		r.Post("/api/oidc/device/token", handleDeviceToken(db, cfg.OIDC.SessionMaxAge, notify.PublicURL))
+	}
+
 	// All other /api routes require a valid API key.
 	r.Group(func(r chi.Router) {
 		r.Use(AuthMiddleware(db))
 
 		r.Get("/api/me", handleMe(db))
+
+		// Approving or refusing a device login is done by somebody signed in
+		// to a browser, and needs the same SSO configuration the flow does.
+		if cfg.OIDC.Enabled() {
+			r.Post("/api/oidc/device/approve", handleDeviceDecision(db, true))
+			r.Post("/api/oidc/device/deny", handleDeviceDecision(db, false))
+		}
 		r.Put("/api/me/onboarding", handleDismissOnboarding(db))
 		// Proves the topic works, which is the only part of "notifications are
 		// set up" that the person holding the phone can confirm.