Sign in through an OpenID Connect provider, and from a terminal

terdut can now sign people in through any OIDC provider (written against
Authentik), and let groups at the provider decide who may sign in, which
teams they belong to and whether they administer the install. Password
login keeps working alongside it; TERDUT_PASSWORD_LOGIN=false turns it off,
and is refused at startup unless SSO is configured. With no TERDUT_OIDC_*
setting nothing changes, so every existing install behaves as before.

Identity is (issuer, subject), never email or username: those are mutable
at the provider and a recycled address must not inherit an account. An
existing user is linked by email only when the provider marks it verified,
or TERDUT_OIDC_TRUST_EMAIL is set, which Authentik needs.

Group grants are marked source='oidc' on team_members and users, and the
sync changes only those rows. Hand-made memberships and administrators
are left alone, and the sync bypasses the last-owner and last-admin guards
because the provider is the source of truth for what it grants. Editing
managed access by hand is refused with 409, since the next sign-in would
undo it. The web UI badges it as SSO and disables the controls.

Groups are read only at sign-in, so an SSO session carries a hard ceiling
(sessions.max_expires_at, 12h by default) that sliding never extends.
There is no refresh token, which means API keys of somebody removed at the
provider stay valid until an administrator disables the user. That is
accepted and documented, not fixed.

A client with no browser, the TUI over SSH, signs in with a device code
run by terdut itself (POST /api/oidc/device and /device/token), so the
terminal never talks to the provider and ends up with the ordinary
terdut_session cookie. Only a browser session can approve a code; an API
key cannot. /device?code= sends a signed-out visitor through sign-in and
back, which is what oidc_logins.next is for.

oauth2 is pinned to v0.36.0: v0.37 needs Go 1.26 and the Dockerfile
builds on 1.25.

Migrations 011 and 012 add tables and defaulted columns only.

internal/web/static/js/app.js

@@ -14,6 +14,7 @@ import * as team from './team.js';
 import * as admin from './admin.js';
 import * as adminuser from './adminuser.js';
 import * as adminteam from './adminteam.js';
+import * as device from './device.js';
 
 const $ = (id) => document.getElementById(id);
 
@@ -30,6 +31,8 @@ const SECTIONS = {
   adminuser: { title: 'User', view: adminuser, nav: 'admin' },
   adminteam: { title: 'Team', view: adminteam, nav: 'admin' },
   more: { title: 'Account', view: account },
+  // Reached by link from a terminal's sign-in prompt, not from the nav.
+  device: { title: 'Sign in a terminal', view: device },
 };
 
 // The mobile hamburger menu's contents — the same sections the desktop
@@ -61,7 +64,7 @@ function parseRoute(pathname) {
   if (t) return { section: 'admin', tab: t.tab };
   const tt = team.TABS.find((x) => x.path === `/${name}`);
   if (tt) return { section: 'team', tab: tt.tab };
-  if (name === 'oncall' || name === 'alerts' || name === 'stats' || name === 'more') return { section: name };
+  if (name === 'oncall' || name === 'alerts' || name === 'stats' || name === 'more' || name === 'device') return { section: name };
   return { section: 'queue', incident: null };
 }
 
@@ -227,6 +230,7 @@ async function boot() {
   $('login-form').addEventListener('submit', onLogin);
   $('signup-form').addEventListener('submit', onSignup);
   $('menu-btn').addEventListener('click', openNavMenu);
+  ssoErrorCode = takeSSOError();
 
   // /signup is the one route that works without a session.
   if (location.pathname.replace(/\/$/, '') === '/signup') {
@@ -236,6 +240,9 @@ async function boot() {
   }
 
   try {
+    // Before anything renders: the account view decides from it whether a
+    // password is worth offering to set.
+    await loadAuthConfig();
     state.me = await api.me();
     await loadTeams();
     // The Admin tab exists only for an administrator. Somebody who types /admin
@@ -331,17 +338,87 @@ async function onSignup(e) {
   }
 }
 
-function showLogin() {
+// Why single sign-on sent the browser back, by the code the server puts in
+// ?sso_error=. The provider's name is the one the administrator configured.
+function ssoErrorText(code, name) {
+  const sso = name || 'single sign-on';
+  return {
+    denied: `Signing in with ${sso} was cancelled or refused.`,
+    expired: 'That sign-in expired or was already used. Try again.',
+    failed: `Signing in with ${sso} failed. Try again, and tell an administrator if it keeps happening.`,
+    unavailable: `${sso} could not be reached. Try again in a moment.`,
+    not_allowed: 'Your account is not allowed to use terdut. Ask an administrator to add you to the right group.',
+    no_email: `${sso} did not send an email address for you, which terdut needs.`,
+    email_conflict: 'An account with your email address already exists and could not be linked to this sign-in. Ask an administrator.',
+    disabled: 'Your account is disabled. Ask an administrator.',
+  }[code] || `Signing in with ${sso} failed.`;
+}
+
+// Reads how the server can be signed in to. An older server has no such
+// endpoint, and one that cannot be asked is treated as offering passwords only:
+// the form that always existed is better than a blank page.
+async function loadAuthConfig() {
+  try {
+    state.auth = await api.authConfig();
+  } catch {
+    /* keep the last answer, or the defaults */
+  }
+  return state.auth;
+}
+
+// The reason the last single sign-on attempt failed, read once at boot. It is
+// held here rather than re-read from the address because showLogin runs more
+// than once on the way to the form (the 401 from /api/me reaches it through the
+// API layer and again through boot's own catch), and only the first would see it.
+let ssoErrorCode = null;
+
+// Takes ?sso_error= off the address, so a reload does not repeat the message.
+function takeSSOError() {
+  const params = new URLSearchParams(location.search);
+  const code = params.get('sso_error');
+  if (code === null) return null;
+  params.delete('sso_error');
+  const query = params.toString();
+  history.replaceState(null, '', location.pathname + (query ? `?${query}` : '') + location.hash);
+  return code;
+}
+
+async function showLogin() {
   poll.stop();
   ui.closeSheet(null);
   reset();
-  $('boot').hidden = true;
   $('app').hidden = true;
-  $('login').hidden = false;
   $('signup-form').hidden = true;
+
+  // Ask before showing anything, so the form does not flash the password
+  // fields at somebody whose server has turned them off.
+  const auth = await loadAuthConfig();
+  const sso = auth.oidc?.enabled ? auth.oidc : null;
+  const passwords = auth.password_login !== false;
+
+  const link = $('sso-link');
+  link.hidden = !sso;
+  if (sso) {
+    link.textContent = `Sign in with ${sso.name || 'SSO'}`;
+    // Come back to the page that was asked for: a link to /device?code=... has
+    // to survive the trip through the provider. The server only honours paths
+    // on this server, and ignores the front page.
+    const here = location.pathname + location.search;
+    link.href = here === '/' ? '/api/oidc/login' : `/api/oidc/login?next=${encodeURIComponent(here)}`;
+  }
+  $('login-or').hidden = !(sso && passwords);
+  $('password-login').hidden = !passwords;
+
+  const ssoErr = $('sso-error');
+  ssoErr.hidden = ssoErrorCode === null;
+  if (ssoErrorCode !== null) ssoErr.textContent = ssoErrorText(ssoErrorCode, sso?.name);
+
+  $('boot').hidden = true;
+  $('login').hidden = false;
   $('login-form').hidden = false;
   const form = $('login-form');
-  form.querySelector('.form-error').hidden = true;
+  form.querySelector('#password-login .form-error').hidden = true;
+  if (!passwords) return;
   // Only offer the door that is open. Somebody without an invite on an
   // invite-only server should be told, not sent to a form that refuses them.
   api.signupInfo().then((info) => {
@@ -354,9 +431,13 @@ function showLogin() {
 async function onLogin(e) {
   e.preventDefault();
   const form = e.currentTarget;
-  const err = form.querySelector('.form-error');
+  // Not the first .form-error: that one is the single sign-on message above.
+  const err = form.querySelector('#password-login .form-error');
   const btn = form.querySelector('button[type=submit]');
   err.hidden = true;
+  // Whatever single sign-on said is about the last attempt, not this one.
+  ssoErrorCode = null;
+  $('sso-error').hidden = true;
   btn.disabled = true;
   try {
     state.me = await api.login(form.username.value.trim(), form.password.value);
@@ -380,6 +461,7 @@ export async function signOut() {
 }
 
 function showApp() {
+  ssoErrorCode = null;
   $('boot').hidden = true;
   $('login').hidden = true;
   $('app').hidden = false;