hsiegeln 9d2e6f30a7 Move OIDC config from env vars to database with admin API ...

OIDC provider settings (issuer, client ID/secret, roles claim) are
now stored in ClickHouse and managed via admin REST API at
/api/v1/admin/oidc. This allows runtime configuration from the UI
without server restarts.

- New oidc_config table (ReplacingMergeTree, singleton row)
- OidcConfig record + OidcConfigRepository interface in core
- ClickHouseOidcConfigRepository implementation
- OidcConfigAdminController: GET/PUT/DELETE config, POST test
  connectivity, client_secret masked in responses
- OidcTokenExchanger: reads config from DB, invalidateCache()
  on config change
- OidcAuthController: always registered (no @ConditionalOnProperty),
  returns 404 when OIDC not configured
- Startup seeder: env vars seed DB on first boot only, then admin
  API takes over
- HOWTO.md updated with admin OIDC config API examples

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-14 13:01:05 +01:00

..

01-schema.sql

test(01-03): add integration tests for health, OpenAPI, protocol version, forward compat, and TTL

2026-03-11 12:03:00 +01:00

02-search-columns.sql

feat(02-01): add schema extension and core search/detail domain types

2026-03-11 16:05:14 +01:00

03-users.sql

Add RBAC with role-based endpoint authorization and OIDC support

2026-03-14 12:35:45 +01:00

04-oidc-config.sql

Move OIDC config from env vars to database with admin API

2026-03-14 13:01:05 +01:00