[m-t-a97]

Summary

Hardens the OAuth2 plugin to prevent account takeover and fixes token persistence, flow validation, provider configuration, and response handling.

Security

• Provider account identity is now authoritative. An OAuth identity always resolves to the account owner and cannot switch to a user matched only by email.
• Auto-linking by email requires a provider-asserted verified email. Unverified provider emails never link an existing user.
• Authenticated callbacks now exchange the code and link the provider account instead of returning early.
• OAuth token writes are account-scoped, encrypted at write time, preserve stored refresh tokens and expiry when omitted, and reject expired tokens.
• Added provider-bound, signed, single-use state and PKCE end to end.
• redirect_to is validated against trusted origins and relative paths.
• OAuth2 flow cookies use configuration for Secure, Domain, and SameSite and are cleared on every terminal path.
• Errors use typed HTTP status mapping and no longer leak internal or provider details.
• Callback responses no longer expose the session token, IP address, or user agent.
• Provider HTTP calls now have a timeout and a 1 MiB response limit.

Added

• AccountService.UpdateOAuth2Tokens for account-scoped token persistence.
• UserInfo.EmailVerified populated from provider data.
• GenericProvider registration with configurable endpoints, scopes, and field mappings.
• ProviderConfig.Enabled (*bool), provider HTTP timeout, and email verification field mapping.
• OAuth2 route mappings in the sample config.toml.

Changed

• ProviderConfig.Enabled is a pointer: absent means enabled, explicit false disables it.
• Environment credentials override only client ID and secret; partial environment credentials fail at startup.
• Provider IDs are canonicalized to lower case; missing or malformed account IDs are rejected.
• Provider registration is deterministic, and use cases are built once during Init.
• Callback responses use a safe session DTO instead of the full session model.
• Error statuses changed from 400 to 401, 404, 409, 422, 502, or 500.

Removed

• Unimplemented RefreshRequest, RefreshResponse, LinkAccountRequest, LinkAccountResponse, RefreshResult, and LinkAccountResult types.
• Unused OAuth2 event constants, eventBus wiring, VerifyHMAC, IsProviderEnabled, and handler constructors.

Migration

• In-flight OAuth2 flows are invalidated by the cookie and state format changes (maximum five minutes).
• Audit and relink or delete account rows with account_id values of '', '<nil>', or scientific notation.
• Force reauthentication for accounts whose stored tokens cannot be decrypted.
• Clients reading session.token from the callback JSON must use the session cookie instead.