feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/tests/test_config.py

@@ -105,3 +105,38 @@ def test_ldap_server_must_not_be_a_url(valid_env):
 def test_a_missing_ca_file_is_reported(valid_env, tmp_path):
     with pytest.raises(ConfigError, match="LDAP_CA_FILE: must be an existing file"):
         load_config({**valid_env, "LDAP_CA_FILE": str(tmp_path / "missing.pem")})
+
+
+@pytest.mark.parametrize(
+    "name", ["OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_CLIENT_SECRET", "PUBLIC_BASE_URL"]
+)
+def test_each_oidc_variable_is_required(valid_env, name):
+    del valid_env[name]
+    with pytest.raises(ConfigError, match=name):
+        load_config(valid_env)
+
+
+def test_oidc_settings_are_loaded_and_the_secret_is_not_printed(valid_env):
+    oidc = load_config({**valid_env, "PUBLIC_BASE_URL": "https://portal.example.test/"}).oidc
+    assert oidc.issuer == "https://idp.example.test/application/o/portal/"
+    assert oidc.redirect_uri == "https://portal.example.test/auth/callback"
+    assert "client-secret" not in repr(oidc)
+
+
+@pytest.mark.parametrize(
+    ("name", "value"),
+    [
+        ("OIDC_ISSUER", "http://idp.example.test/"),
+        ("PUBLIC_BASE_URL", "http://portal.example.test"),
+        ("PUBLIC_BASE_URL", "https://portal.example.test/app"),
+        ("PUBLIC_BASE_URL", "portal.example.test"),
+    ],
+)
+def test_oidc_addresses_must_be_https_origins(valid_env, name, value):
+    with pytest.raises(ConfigError, match=name):
+        load_config({**valid_env, name: value})
+
+
+def test_a_plain_http_origin_is_allowed_only_in_debug(valid_env):
+    env = {**valid_env, "PUBLIC_BASE_URL": "http://localhost:8000"}
+    assert load_config({**env, "DEBUG": "true"}).oidc.public_base_url == "http://localhost:8000"