chore: lock the plugin boundary and remove 2.9.0 leftovers

plugins/sso/manifest.json

@@ -43,6 +43,24 @@
           "permission": "manage"
         }
       ]
+    },
+    "http": {
+      "legacyRedirects": [
+        {
+          "from": "/users/oidc-config",
+          "to": "/config"
+        },
+        {
+          "from": "/users/oidc/callback",
+          "to": "/callback",
+          "status": 308
+        },
+        {
+          "from": "/users/oidc/backchannel-logout",
+          "to": "/backchannel-logout",
+          "status": 308
+        }
+      ]
     }
   },
   "locales": "locales",

plugins/sso/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -b ../../tsconfig.plugins.json ../../tsconfig.plugins.frontend.json",
+    "typecheck": "tsc -b ../../tsconfig.plugins.backend.json ../../tsconfig.plugins.frontend.json",
     "validate": "termix-plugin validate"
   },
   "dependencies": {

plugins/sso/tests/backend/legacy-urls.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { validateManifest } from "@termix/plugin-sdk/manifest";
+import manifest from "../../manifest.json";
+
+// Old URLs something outside Termix still calls keep reaching the plugin.
+const redirects = manifest.contributes.http.legacyRedirects as unknown[];
+
+describe("legacy URLs", () => {
+  it("declares them in a manifest that validates", () => {
+    expect(validateManifest(manifest)).toEqual([]);
+  });
+
+  it("redirects /users/oidc-config, which 2.8 clients read", () => {
+    expect(redirects).toContainEqual({
+      from: "/users/oidc-config",
+      to: "/config",
+    });
+  });
+
+  it("redirects /users/oidc/callback, which identity providers were set up with before 2.9", () => {
+    expect(redirects).toContainEqual({
+      from: "/users/oidc/callback",
+      to: "/callback",
+      status: 308,
+    });
+  });
+
+  it("redirects /users/oidc/backchannel-logout, which identity providers send back-channel logouts to", () => {
+    expect(redirects).toContainEqual({
+      from: "/users/oidc/backchannel-logout",
+      to: "/backchannel-logout",
+      status: 308,
+    });
+  });
+});