feat(oauth): sign in through the legacy identity provider during migration cutover

[Bccorb]

Part of #334.

Problem

Nobody switches an organization's sign-in in one day. During cutover, users need to be able to sign in with the system they have today, land on their imported Seamless Auth account, and be moved onto passkeys from there. Cutover then needs to happen per group, with a way back.

Proposal

Use the existing OAuth provider support (src/services/oauthService.ts, providers configured with authorizationUrl / tokenUrl) as the bridge from the legacy identity provider:

• Confirm whether today's OAuth flow links to an existing (imported) user, and on what. Linking must require a verified email from the provider, or a match on the imported externalId, never an unverified claim. Shipped in v0.16.0 (GHSA-p3fh-cq88-92h6): linking now needs a provider-verified email, and Entra links on the immutable oid
• OIDC discovery and ID token validation for providers such as Entra ID, Okta and Google Workspace, if not already covered. Shipped in v0.16.0: ID token verification against the configured issuer and jwksUri. Discovery (fetching .well-known/openid-configuration) is not implemented; both values are set on the provider explicitly
• After a legacy-provider sign-in, a user without a passkey is sent into passkey enrollment rather than straight into the app. Shipped in feat(oauth): passkey enrollment step and per-organization provider retirement #346: nextStep: 'enroll_passkey' for providers with promptPasskeyEnrollment; handled in feat(oauth): passkey enrollment after a legacy provider sign-in seamless-auth-react#156 and the OAuth starter (feat(web): follow nextStep into passkey enrollment in the OAuth starter seamless-templates#95)
• Per-organization switch to turn the legacy provider off at cutover, and back on for rollback, with an auth event for each change. Shipped in feat(oauth): passkey enrollment step and per-organization provider retirement #346 (PUT/DELETE /admin/organizations/:organizationId/oauth-providers/:providerId/retirement, with admin_oauth_provider_retired / _restored events); feat(oauth): revoke members' sessions when a provider is retired #348 also revokes members' sessions on retirement
• Conformance coverage for the link-then-enroll path (the harness already has a mock OIDC provider). Shipped in feat(verify): cover the OAuth migration cutover path seamless-cli#217

Security

High-stakes path (account linking). Run a security review before merging.

[Bccorb]

Remaining work is in flight, in merge order:

1. feat(oauth): add schemas for legacy identity provider cutover seamless-auth-types#81: promptPasskeyEnrollment on providers, nextStep on the sign-in response, retiredOAuthProviders on organizations, the oauth_provider_retired code and the retirement auth events.
2. API branch feat/oauth-cutover-enrollment-retirement: nextStep: 'enroll_passkey' for providers with promptPasskeyEnrollment set, and PUT/DELETE /admin/organizations/:organizationId/oauth-providers/:providerId/retirement. A member of a retiring organization is refused with 403 before any account is claimed or linked. The PR opens once types 0.25.0 is published.
3. feat(proxy): pass the organization OAuth provider retirement routes through seamless-auth-server#171: adapter passthroughs for the two retirement routes.
4. fix(ci): install react-router-dom for the react package tests seamless-auth-react#155 (unblocks react CI), then branch feat/oauth-cutover there: the callback routes nextStep into passkey enrollment and keeps returnTo. Its PR opens after types 0.25.0 too.

Still open here: whether retiring a provider should also revoke existing sessions, and conformance coverage for the link-then-enroll path.

[Bccorb]

Resolved. Everything in the checklist is merged:

• feat(oauth): passkey enrollment step and per-organization provider retirement #346: nextStep: 'enroll_passkey' for providers with promptPasskeyEnrollment, and per-organization retirement and restore of a provider.
• feat(oauth): revoke members' sessions when a provider is retired #348: retiring a provider also revokes its members' sessions.
• feat(verify): cover the OAuth migration cutover path seamless-cli#217: conformance coverage for link, enroll, retire and restore.
• feat(oauth): add schemas for legacy identity provider cutover seamless-auth-types#81 and chore: update version and changelog #84, released in types 0.25.0.
• feat(oauth): passkey enrollment after a legacy provider sign-in seamless-auth-react#156, released in react 0.14.0.

Not released yet. The auth API changes (#346, #348) are on main but not in a release. The next release is being held until more items from #334 land; release PR #347 stays open until then.

Still open downstream, none of them blocking this issue:

• feat(proxy): pass the organization OAuth provider retirement routes through seamless-auth-server#171: adapter passthroughs for the retirement routes. Merge it once the API is released.
• fix(web): import AuthRoutes from @seamless-auth/react/routes seamless-templates#94 and feat: add admin routes to manage OAuth providers at runtime #95: the AuthRoutes import fix and nextStep handling in the OAuth starter.