Feat/OIDC login v3

[michaelhthomas]

Description

• Fixes #XXXX

How Has This Been Tested?

Screenshots / Logs (if applicable)

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

[github-actions]

The i18n check failed because translation messages are out of sync.

This usually happens when you've added or modified translation strings in your code but haven't updated the translation file.

Please run pnpm i18n:extract and commit the changes.

In general, to fix missing rate limiting on an authorization endpoint in an Express app, you add a rate-limiting middleware (e.g., from express-rate-limit) and apply it specifically to that route (or to the whole router) so that each client can only invoke the endpoint a bounded number of times per time window. This reduces the risk of denial-of-service attacks and brute-force attempts without changing the core business logic of the handler.

For this codebase, the minimal, targeted fix is to: (1) import express-rate-limit at the top of server/routes/auth.ts; (2) define a rate limiter configuration dedicated to OIDC callback requests (e.g., limiting per IP to a modest number of requests per 15 minutes); and (3) apply this limiter as middleware on the /oidc/callback/:slug route while leaving all existing handler logic untouched. We will place the limiter definition near the router instantiation so it can be reused if needed and chain it into the existing authRoutes.post('/oidc/callback/:slug', ...) line as an additional middleware argument.

Concretely:

• Add import rateLimit from 'express-rate-limit'; alongside existing imports.
• After const authRoutes = Router();, define const oidcCallbackLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100, standardHeaders: true, legacyHeaders: false }); (values chosen as a reasonable default, preserving functionality while limiting abuse).
• Modify the route definition on line 755 from authRoutes.post('/oidc/callback/:slug', async (req, res, next) => { to authRoutes.post('/oidc/callback/:slug', oidcCallbackLimiter, async (req, res, next) => {.

This keeps all existing behavior intact for normal users while adding protection against excessive invocation of the OIDC callback.

In general, the fix is to introduce rate limiting middleware for routes that perform authentication/authorization, especially those that may trigger remote calls or other expensive operations. In an Express app, the common approach is to use express-rate-limit to cap the number of requests per IP over a time window.

For this specific code, the best low-impact fix is to:

1. Import express-rate-limit in server/routes/auth.ts.
2. Define a limiter specifically for OIDC login, with reasonable defaults (e.g., 10 requests per 15 minutes per IP).
3. Apply that limiter to the /oidc/login/:slug route by passing it as middleware before the async handler.

This avoids changing the existing logic of the route while protecting it from brute-force or DoS-style abuse. All changes are confined to server/routes/auth.ts: add one import, add a const oidcLoginLimiter = rateLimit({ ... }) near the top (after router creation is a natural spot), and change the route definition from authRoutes.get('/oidc/login/:slug', async (req, res, next) => { ... }) to authRoutes.get('/oidc/login/:slug', oidcLoginLimiter, async (req, res, next) => { ... }).