feat: add OAuth provider adapters

[Zetazzz]

Stack

• base: feat/oauth-sso-errors-config (feat: add OAuth server config and errors #1683)
• this PR contains only the OAuth package primitive/adapter increment

Summary

• replace the legacy hard-coded OAuth client/middleware surface with a protocol-neutral ProviderAdapter contract
• add 32-byte opaque state and nonce generation plus mandatory RFC 7636 S256 PKCE primitives
• add exact HTTPS Provider endpoint allowlists, protected authorization parameters, bounded no-redirect JSON requests, and safe failure classification
• implement registered Google/OIDC and GitHub/OAuth adapters that return only normalized external identity data
• validate Google ID-token signature, issuer, audience, expiry, and nonce with jose; keep all Provider tokens and PKCE verifier server-side

Boundaries

This PR does not add Express routes, Cookies, Tenant/database lookup, account association, GraphQL orchestration, session issuance, or handoff behavior. Provider configuration is supplied by the future Tenant-scoped Context integration; adapters do not read environment variables or databases.

The old Express middleware, browser state Cookie, /auth/providers discovery handler, raw Provider profile, and Facebook/LinkedIn hard-coded registry are removed rather than retained as a fallback.

Validation

• pnpm --filter @constructive-io/oauth build
• pnpm --filter @constructive-io/oauth exec jest --runInBand (3 suites, 15 tests)
• focused ESLint on packages/oauth/src and packages/oauth/__tests__
• frozen offline lockfile install for @constructive-io/oauth
• CommonJS package export smoke test
• git diff --check

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jose@​5.10.0

View full report