feat: support for OIDC authentication

[rophy]

A prototype to enable OIDC support for #809.

How to test:

1. docker-compose -f docker-compose.oidc.yml up -d, which uses Soluto/oidc-server-mock for a simple OIDC server provider, configured with one client ID and two user accounts.

2. Load kutt login page http://localhost:3000/login

3. You should see a "Login with OIDC" button (actually a link) at bottom:

4. Clicking the link redirects you to http://7f000101.nip.io:8080/

   • The FQDN actually resolves to 127.0.0.1 for browser, and oidc-server-mock container IP for kutt container.
   • Such "magical DNS" is needed for local development, since OIDC requires both human browser and kutt backend to interact with OIDC endpoints. In real environments, OIDC_ISSUER should point to a real OIDC provider such as Google or Facebook.

5. Login with the user accounts defined in docker-compose. Successful login should redirect back to kutt homepage.

6. If the user does not exist, it is created with a random password, with email verified.

7. The passport strategy of openid-client package requires express sesssion to be enabled. For cookie-session, it creates cookie like this:

What are still missing in this PR:

1. Logging out kutt should log out OIDC as well.
2. Apps which support OIDC should be able to customize the login button, such as "Login with Google".
3. Once OIDC is enabled, it's common that site admins will want to disable form-based logins. Ideally should be supported via config.

[rophy]

Tested OK for me for (a) local oidc-server-mock and (b) auth0.
Note that the first time you run docker-compose up, kutt crashes trying to discover OIDC endpoints while oidc-server-mock is still starting.

[rophy]

rophy/kutt main branch now points to rophy/oidc branch + auto build.

docker build for testing: https://github.com/rophy/kutt/pkgs/container/kutt/main

[rophy]

Once OIDC is enabled, it's common that site admins will want to disable form-based logins. Ideally should be supported via config.

env.DISALLOW_FORM_LOGIN

[poeti8]

Thank you, this looks excellent. I'll try it soon.

[zachmann]

@poeti8 Any update on this? It would be great to have this feature merged.