feat: verify oidc bearer tokens and jit-provision users

backend/libs/configuration/src/environment.spec.ts

@@ -10,6 +10,8 @@ describe('loadEnvironment', () => {
       loadEnvironment({
         DATABASE_URL: 'postgresql://u:p@postgres:5432/db',
         REDIS_URL: 'redis://redis:6379',
+        OIDC_ISSUER: 'https://idp.example.test/',
+        OIDC_AUDIENCE: 'travel-planner-api',
         APP_VERSION: '1.2.3',
         TEAMCITY_BUILD_NUMBER: '42',
         SOURCE_REVISION: 'abc123',
@@ -17,6 +19,8 @@ describe('loadEnvironment', () => {
     ).toEqual({
       databaseUrl: 'postgresql://u:p@postgres:5432/db',
       redisUrl: 'redis://redis:6379',
+      oidcIssuer: 'https://idp.example.test/',
+      oidcAudience: 'travel-planner-api',
       appVersion: '1.2.3',
       teamCityBuildNumber: '42',
       sourceRevision: 'abc123',

backend/libs/configuration/src/environment.ts

@@ -1,6 +1,8 @@
 export interface AppEnvironment {
   databaseUrl: string;
   redisUrl: string;
+  oidcIssuer: string;
+  oidcAudience: string;
   appVersion: string;
   teamCityBuildNumber: string;
   sourceRevision: string;
@@ -16,6 +18,8 @@ export function loadEnvironment(env: NodeJS.ProcessEnv): AppEnvironment {
   return {
     databaseUrl: required(env, 'DATABASE_URL'),
     redisUrl: required(env, 'REDIS_URL'),
+    oidcIssuer: required(env, 'OIDC_ISSUER'),
+    oidcAudience: required(env, 'OIDC_AUDIENCE'),
     appVersion: env.APP_VERSION?.trim() || 'dev',
     teamCityBuildNumber: env.TEAMCITY_BUILD_NUMBER?.trim() || 'local',
     sourceRevision: env.SOURCE_REVISION?.trim() || 'local',