Use code exchange for OIDC

[DavidMStraub]

No description provided.

[Copilot]

Pull request overview

This PR updates the OIDC flow to avoid sending tokens back to the browser via cookies, instead using a short-lived, single-use “exchange code” that the frontend redeems via /oidc/tokens/. It also adjusts CORS credentials settings accordingly.

Changes:

• Replace OIDC callback token handoff from HttpOnly cookies to a server-side cached, signed exchange code in the redirect fragment.
• Change /oidc/tokens/ from a cookie-based GET exchange to a JSON-body POST exchange using a new Marshmallow schema.
• Disable CORS supports_credentials since the OIDC flow no longer relies on credentialed cookie requests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/test_endpoints/test_oidc.py	Updates tests to validate code exchange behavior and absence of token leakage.
gramps_webapi/app.py	Disables CORS credential support (supports_credentials=False).
gramps_webapi/api/resources/schemas.py	Adds OIDCTokenExchangeSchema and updates token schema description for code exchange.
gramps_webapi/api/resources/oidc.py	Implements signed exchange code storage/redemption and switches token exchange endpoint to POST.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

gramps_webapi/api/resources/oidc.py:73

• The comment on OIDC_CODE_CACHE_TIMEOUT suggests an expired code could be reported as something other than expired and that redeemed codes remain detectable beyond the code lifetime. In practice, _redeem_exchange_code aborts on SignatureExpired before consulting the cache/claim marker, so this comment is misleading. Please adjust the comment to match the actual behavior (valid-but-missing entry => server/cache error; valid-but-replayed => "already used").

# The cached entries outlive the code itself, so that an expired code is always
# reported as expired rather than as a missing entry, and so that a redeemed one
# is still known to have been redeemed.