Merge branch 'feature/iam-06-sso-anmeldung-ueber-oidc' into feature/qa-02-pruefgate-identitaet-mandanten

migrations/tenant/0004_oidc_states.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS oidc_states;

migrations/tenant/0004_oidc_states.up.sql

@@ -0,0 +1,10 @@
+-- CSRF-/Replay-Schutz fuer OIDC-Login (IAM-06, siehe
+-- core-kanban/tickets/IAM-06.md). Einmal-Verwendung erzwungen ueber
+-- used_at IS NULL in der Consume-Abfrage, analog IAM-03/IAM-09.
+CREATE TABLE oidc_states (
+    state      TEXT PRIMARY KEY,
+    nonce      TEXT NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    used_at    TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);