feat(sso): log OIDC groups diagnostics without exposing tokens or PII

[snevesbarros]

Summary

Group-mapping failures with OIDC providers (notably Okta) were hard to diagnose: a missing groups claim was coerced to [], and the denial log said only "no matching role mapping". This adds targeted diagnostics that show the shape of what the IdP sent, without logging sensitive values.

• oidc-strategy.js: one line per login with the claim names in the ID token and userinfo, granted scopes, the configured groupsClaim, where it was found (id_token / userinfo / none), its type and the group count. A missing claim is now distinguishable from an empty or scalar one.
• role-mapper.js: new explainRole() returns the role plus matched mappings, whether the default role was used, and group counts. resolveRole() delegates to it with unchanged behaviour.
• provider-user-service.js: logs the role decision (role, matchedMappings, defaultRoleUsed, counts). Also benefits SAML and LDAP since they share this service.

Security considerations

• Never logged: tokens, claim values, the userinfo payload, callback URL, headers/cookies.
• Raw group names are only logged under a separate auth:oidc:groups debug namespace (opt-in), capped at 50 entries / 100 chars each.
• IdP-supplied strings have control characters stripped to prevent log injection.
• The login line includes the username/email, as the existing provisioning log lines already do.

Usage

Set DEBUG=auth:oidc,auth:provisioning (add auth:oidc:groups temporarily to see exact group names). Nothing is logged without DEBUG, as before.

Test plan

• New test/oidc-logging.tests.js (15 tests): claim shapes, sanitising, explainRole, and the verify callback, including assertions that tokens, PII and raw group names do not appear in output by default
• Existing role-mapper.resolveRole tests pass (11)
• ESLint clean on changed files
• Verify against a real Okta login

🤖 Generated with Claude Code