feat: add stable OIDC authentication

apps/web/src/App.tsx

@@ -107,6 +107,7 @@ import { useCatalogOperations } from './hooks/useCatalogOperations';
 import { usePricingRuleSetOperations } from './hooks/usePricingRuleSetOperations';
 import { useRuntimePolicySetOperations } from './hooks/useRuntimePolicySetOperations';
 import { persistAccessToken, readStoredAccessToken } from './lib/auth-storage';
+import { completeOIDCLogin, oidcLoginEnabled, startOIDCLogin, startOIDCLogout } from './lib/oidc';
 import { runTask } from './lib/run-task';
 import { AdminPage } from './pages/AdminPage';
 import { ApiDocsPage } from './pages/ApiDocsPage';
@@ -264,6 +265,18 @@ export function App() {
   currentTaskQueryKeyRef.current = taskListRequestKey;
   currentTransactionQueryKeyRef.current = transactionListRequestKey;
 
+  useEffect(() => {
+    void completeOIDCLogin()
+      .then((result) => {
+        if (!result) return;
+        persistAccessToken(result.accessToken);
+        setToken(result.accessToken);
+      })
+      .catch((err) => {
+        setState('error');
+        setError(err instanceof Error ? err.message : '统一认证登录失败');
+      });
+  }, []);
   useEffect(() => {
     void ensureData(['health']);
   }, []);
@@ -1064,11 +1077,21 @@ export function App() {
     return true;
   }
 
-  function signOut() {
+  async function signOut() {
     resetAuthenticatedSession();
+    if (await startOIDCLogout()) return;
     navigatePath('/');
   }
 
+  function loginWithOIDC() {
+    setState('loading');
+    setError('');
+    void startOIDCLogin().catch((err) => {
+      setState('error');
+      setError(err instanceof Error ? err.message : '统一认证登录失败');
+    });
+  }
+
   function showLogin() {
     setAuthMode('login');
     navigatePath(pathForWorkspaceSection('overview'));
@@ -1197,6 +1220,8 @@ export function App() {
             onSubmitExternalToken={submitExternalToken}
             onSubmitLogin={submitLogin}
             onSubmitRegister={submitRegister}
+            oidcEnabled={oidcLoginEnabled()}
+            onOIDCLogin={loginWithOIDC}
           />
         )
       )}
@@ -1254,6 +1279,8 @@ export function App() {
             onSubmitExternalToken={submitExternalToken}
             onSubmitLogin={submitLogin}
             onSubmitRegister={submitRegister}
+            oidcEnabled={oidcLoginEnabled()}
+            onOIDCLogin={loginWithOIDC}
           />
         )
       )}