feat: implement RFC 8252 system browser OIDC authentication for desktop

src/ui/auth/Auth.tsx

@@ -641,6 +641,22 @@ export function Auth({ onLogin }: AuthProps) {
   async function handleOIDCLogin() {
     setOidcLoading(true);
     try {
+      if (isElectron()) {
+        const electronAPI = (window as unknown as { electronAPI?: { oidcSystemBrowserAuth?: (authUrl: string, port: number) => Promise<{ success: boolean; token?: string; error?: string }> } }).electronAPI;
+        if (electronAPI?.oidcSystemBrowserAuth) {
+          const callbackPort = 17832 + Math.floor(Math.random() * 100);
+          const authResponse = await getOIDCAuthorizeUrl(rememberMe, callbackPort);
+          const { auth_url: authUrl } = authResponse;
+          if (!authUrl) throw new Error(t("errors.invalidAuthUrl"));
+          const result = await electronAPI.oidcSystemBrowserAuth(authUrl, callbackPort);
+          if (result.success && result.token) {
+            localStorage.setItem("jwt_token", result.token);
+            window.location.reload();
+            return;
+          }
+          throw new Error(result.error || "Authentication failed");
+        }
+      }
       const authResponse = await getOIDCAuthorizeUrl(rememberMe);
       const { auth_url: authUrl } = authResponse;
       if (!authUrl || authUrl === "undefined")

src/ui/main-axios.ts

@@ -3121,10 +3121,11 @@ export async function changePassword(oldPassword: string, newPassword: string) {
 
 export async function getOIDCAuthorizeUrl(
   rememberMe = false,
+  desktopCallbackPort?: number,
 ): Promise<OIDCAuthorize> {
   try {
     const response = await authApi.get("/users/oidc/authorize", {
-      params: { rememberMe },
+      params: { rememberMe, desktopCallbackPort },
     });
     return response.data;
   } catch (error) {