Federated Login (OAuth Gateway)

All providers register exactly one redirect URI, and per-app routing happens through an {app} path parameter so admin, app, web and www can each receive their callback without provisioning multiple Google/Microsoft/Apple/GitHub clients. Every flow is PKCE S256 and uses a one-shot state token whose SHA-256 binding hash is stored in a short-lived pl_oauth_binding cookie, so a callback on a different device or after a state replay is rejected. Web flows complete by setting pl_access_token and pl_refresh_token as Secure; HttpOnly; SameSite=Lax cookies on .petanque.life.

Native flows return a 64-byte base64url OAuthExchangeCode with a 60-second TTL; the mobile client POSTs to /auth/oauth/exchange and the code is consumed in a single find_one_and_delete — tokens never appear in URLs. Provider integrations normalise into the same identity shape but preserve the provider's own trust signals: Google id_tokens are JWKS-verified against accounts.google.com with sub as provider_user_id and email_verified taken from the claim; Microsoft uses the multitenant common endpoint with a documented email priority chain (Graph mail → id_token email → preferred_username → UPN) and trusts work tenants but marks personal MS accounts as email_verified=False; GitHub validates the access token via GET /user, enforces X-OAuth-Scopes, and resolves the primary verified email via GET /user/emails; Apple uses an ES256 JWT client_secret built from team_id+key_id+private_key, verifies id_tokens against Apple's JWKS, supports the iOS ASAuthorizationController flow via POST /auth/oauth/apple/native, and (per Apple policy) marks emails verified including private-relay addresses. compute_email_verified() encodes this matrix as a single function. Account linking lets multiple identities point at one user: POST /auth/oauth/{provider}/link/{app} requires a fresh authentication (auth_time within 300 s) and returns 401 reauth_required if the session is stale.

Unlinking is protected by a last-auth-method policy: DELETE /auth/me/oauth-identities/{provider} counts email + phone + OAuth identities and refuses with 409 last_auth_method if removal would leave the user with zero login methods, and revokes upstream tokens at Google/GitHub/Apple. A provider-discovery endpoint (GET /auth/oauth/providers) drives the connected-accounts UI in both admin (desktop-first) and app (mobile-first), each implementing fresh-auth preflight and explicit unlink confirmation.