add support for OIDC implicit flow

[bgerrity]

Description & motivation 💭

Work in progress. Addresses #1881.

Adds configurable support for the OIDC Implicit Flow. As that flow is designed for SPAs, this approach shifts auth from the server to the client.

Screenshots (if applicable) 📸

Design Considerations 🎨

Looked at using JS libraries but didn't see a way to mesh it neatly.

Testing 🧪

How was this tested 👻

• Manual testing
• E2E tests added
• Unit tests added

Manual tests

Worked from this guide. Pointed the server to an Okta development app with the configuration below. Can add other users to the app for reproduction.

Screen.Recording.2024-04-01.at.4.07.01.PM.mov

    - label: oidc implicit flow
      type: oidc
      flow: implicit
      # TODO: support optional issuer validation
      authorizationUrl: https://dev-95856544.okta.com/oauth2/v1/authorize  # discovery isn't supported for implicit flow. the endpoint must be provided directly
      clientId: 0oag5vkuazxXyvuel5d7
      scopes:
        - openid
        - profile
        - email

Unit tests

Updated unit tests and added some more. Opened #1915 for some unrelated tests. Happy to take suggestions for additional areas or manual approaches.

Steps for others to test: 🚶🏽‍♂️🚶🏽‍♀️

# unit tests
pnpm vitest

# manual with dev yaml configured
pnpm dev

Checklists

Draft Checklist

• Add testing with feedback

Merge Checklist

Issue(s) closed

#1881

Docs

Any docs updates needed?

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
holocene	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 9, 2024 10:05pm

[CLAassistant]

All committers have signed the CLA.

[bgerrity]

@stevekinney @Alex-Tideman Still a draft and haven't added tests yet but I'm seeking early feedback and guidance on testing against a public IdP.

[bgerrity]

Added some unit tests to maintain coverage. Happy to take feedback on additional testing.

[bgerrity]

Added manual testing against an Okta dev app.

[bgerrity]

made changes to address issues found in review. also added unit tests to define the behavior for handling the hash fragment from the callback.