Sign in through an OpenID Connect provider, and from a terminal

terdut can now sign people in through any OIDC provider (written against
Authentik), and let groups at the provider decide who may sign in, which
teams they belong to and whether they administer the install. Password
login keeps working alongside it; TERDUT_PASSWORD_LOGIN=false turns it off,
and is refused at startup unless SSO is configured. With no TERDUT_OIDC_*
setting nothing changes, so every existing install behaves as before.

Identity is (issuer, subject), never email or username: those are mutable
at the provider and a recycled address must not inherit an account. An
existing user is linked by email only when the provider marks it verified,
or TERDUT_OIDC_TRUST_EMAIL is set, which Authentik needs.

Group grants are marked source='oidc' on team_members and users, and the
sync changes only those rows. Hand-made memberships and administrators
are left alone, and the sync bypasses the last-owner and last-admin guards
because the provider is the source of truth for what it grants. Editing
managed access by hand is refused with 409, since the next sign-in would
undo it. The web UI badges it as SSO and disables the controls.

Groups are read only at sign-in, so an SSO session carries a hard ceiling
(sessions.max_expires_at, 12h by default) that sliding never extends.
There is no refresh token, which means API keys of somebody removed at the
provider stay valid until an administrator disables the user. That is
accepted and documented, not fixed.

A client with no browser, the TUI over SSH, signs in with a device code
run by terdut itself (POST /api/oidc/device and /device/token), so the
terminal never talks to the provider and ends up with the ordinary
terdut_session cookie. Only a browser session can approve a code; an API
key cannot. /device?code= sends a signed-out visitor through sign-in and
back, which is what oidc_logins.next is for.

oauth2 is pinned to v0.36.0: v0.37 needs Go 1.26 and the Dockerfile
builds on 1.25.

Migrations 011 and 012 add tables and defaulted columns only.

internal/web/login_test.go

@@ -0,0 +1,86 @@
+package web
+
+import (
+	"io/fs"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func read(t *testing.T, name string) string {
+	t.Helper()
+	sub, err := fs.Sub(files, "static")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := fs.ReadFile(sub, name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+// The sign-in button has to be a link the browser navigates, not script: the
+// CSP's connect-src is 'self', so a fetch to the identity provider is blocked,
+// and it is a redirect to the provider that the server answers.
+func TestLoginPageOffersSSOAsAPlainLink(t *testing.T) {
+	html := read(t, "index.html")
+	if !regexp.MustCompile(`<a[^>]*id="sso-link"[^>]*href="/api/oidc/login"|<a[^>]*href="/api/oidc/login"[^>]*id="sso-link"`).MatchString(html) {
+		t.Error("index.html has no <a id=sso-link href=/api/oidc/login>")
+	}
+	if !strings.Contains(html, `id="password-login"`) {
+		t.Error("the password fields must sit in #password-login so a server can hide them")
+	}
+}
+
+// Every code the server can put in ?sso_error= must have a message, or a
+// refused person sees a generic failure and cannot tell what to ask for.
+func TestLoginExplainsEverySSOError(t *testing.T) {
+	js := read(t, "js/app.js")
+	for _, code := range []string{
+		"denied", "expired", "failed", "unavailable",
+		"not_allowed", "no_email", "email_conflict", "disabled",
+	} {
+		if !regexp.MustCompile(`\b` + code + `:`).MatchString(js) {
+			t.Errorf("app.js has no message for sso_error=%s", code)
+		}
+	}
+}
+
+// The page a terminal's prompt links to has to be reachable as a route, or the
+// link 404s into the queue and the code is never seen.
+func TestDevicePageIsRoutedAndCallsTheApprovalAPI(t *testing.T) {
+	if !strings.Contains(read(t, "index.html"), `id="view-device"`) {
+		t.Error("index.html has no #view-device section")
+	}
+	app := read(t, "js/app.js")
+	if !strings.Contains(app, "name === 'device'") || !strings.Contains(app, "device: {") {
+		t.Error("app.js does not route /device")
+	}
+	// The SSO button must carry the page asked for through the provider.
+	if !strings.Contains(app, "/api/oidc/login?next=") {
+		t.Error("the SSO link does not carry next=")
+	}
+	dev := read(t, "js/device.js")
+	for _, want := range []string{"approveDevice", "denyDevice"} {
+		if !strings.Contains(dev, want) {
+			t.Errorf("device.js never calls %s", want)
+		}
+	}
+	api := read(t, "js/api.js")
+	for _, want := range []string{"/oidc/device/approve", "/oidc/device/deny"} {
+		if !strings.Contains(api, want) {
+			t.Errorf("api.js has no call to %s", want)
+		}
+	}
+}
+
+// SSO-managed access must be marked in every view that edits it.
+func TestManagedAccessIsMarkedWhereItIsEdited(t *testing.T) {
+	for _, file := range []string{"js/team.js", "js/adminteam.js", "js/adminuser.js", "js/admin.js"} {
+		js := read(t, file)
+		if !strings.Contains(js, "ssoBadge") || !strings.Contains(js, "SSO_MANAGED") {
+			t.Errorf("%s does not mark or explain SSO-managed access", file)
+		}
+	}
+}