Fix white-screen-on-login (cross-origin OIDC discovery), plus third-party OAuth sign-in and refresh diagnostics

[nbudin]

Purpose

Follow-up to the OAuth-callback fix (#11686). This started as "add telemetry so we can finally see the white-screen-on-login," but along the way we reproduced it and found the root cause, so it now actually fixes it — plus a couple of other login problems that surfaced while digging.

The headline: an anonymous visitor hitting a login-required page got a blank screen because the login redirect depends on an OIDC discovery fetch to the issuer host, which is cross-origin (a convention page reaching the root site). When that request is blocked — Brave's shields in production, untrusted self-signed certs in local dev (where it showed up as GET 0 /.well-known/openid-configuration) — initiateAuthentication can't build the redirect URL, and the guard rendered nothing while it waited, with no .catch to surface the failure. Permanent white screen, nothing reported.

The fixes, roughly in order of impact:

• Stop depending on cross-origin discovery. The SPA only needs the issuer + authorization + end-session endpoints, and token exchange/refresh already go through our own same-origin /oauth_session/*. So we serve those three in /client_configuration (same-origin, already fetched at boot) and build openid-client's Configuration directly instead of calling discovery(). No cross-origin request in the login path anymore.
• Never render a blank page while redirecting. useLoginRequired now renders a spinner while it redirects, or an error + Retry if initiating auth fails (and reports it), instead of <></>.
• Capture the failure if it happens anyway. Error reporting is now initialized during boot rather than in an AppRoot effect that never runs when the initial render crashes — which is why this class of failure was invisible before.

Two more login issues fixed along the way:

• Signing in to a third-party OAuth app (e.g. Cantrip) failed with a CORS error: the sign-in form submitted via fetch() and followed the post-login redirect chain into the relying app's callback, which is cross-origin and got blocked — burning the one-time auth code in the process. Now the server returns the redirect location as JSON and the browser navigates top-level, which isn't subject to CORS and doesn't depend on the relying app's headers.
• Convention sites logging people out overnight — I couldn't pin the cause from static analysis (timing points at the nightly cleanup cron, but the refresh-token rotation should survive it), so this instruments /oauth_session/refresh to record why it returns invalid_grant. Diagnostic only; we'll follow up once we have a real event.

Changes

💻 Engineer-facing

• /client_configuration now returns oidc_authorization_endpoint + oidc_end_session_endpoint (built on the issuer host); the SPA constructs the openid-client Configuration from them, with no discovery() call.
• useLoginRequired returns the element to render while signed out (spinner / error+retry) instead of a bare boolean; the route guard and inline gates render it. It reports failures and fires the redirect only once per mount.
• SessionsController#create responds to JSON requests with { location } (200) instead of a 302; DeviseSignInPage navigates top-level. safe_sign_in_location preserves the open-redirect guard. Inline sign-in errors (JSONFailureApp) are unchanged.
• Error-reporting init hoisted into the boot sequence; ErrorReporting#setCurrentUser attaches the user id once AppRootQuery resolves.
• OAuthSessionsController#refresh reports cookie_absent / token_not_found / grant_rejected via ErrorReporting (filterable tag oauth_refresh_failure); no token material is logged.

Risks

• The sign-in create change alters the JSON response shape (was a 302, now { location }); the no-JS navigational path still redirects.
• Building the OIDC Configuration from server-provided metadata instead of discovery means we rely on those three endpoints being correct in /client_configuration. There's a controller test, but worth a sanity check that login still redirects correctly in each environment.

Testing

tsc --noEmit, eslint, and rubocop all pass. New tests: sessions + oauth_sessions + client_configuration controller tests, and vitest coverage for useLoginRequired (signed-in / redirecting / failure paths) and openid (Configuration built from metadata, no fetch). The white screen was also reproduced locally and confirmed to be the discovery status 0.

Release plan and notes

🚢 — note the refresh instrumentation is diagnostic only; expect a small follow-up PR once an overnight oauth_refresh_failure event comes in to tell us why the refresh fails.

🤖 Generated with Claude Code

[github-actions]

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
app/controllers/application_controller.rb	🟠 60.19%	🟠 66.67%	🟢 6.48%
app/controllers/json_failure_app.rb	🟠 50%	🟢 100%	🟢 50%
app/controllers/oauth_sessions_controller.rb	🔴 35.94%	🔴 44%	🟢 8.06%
app/controllers/sessions_controller.rb	🔴 0%	🟠 62.5%	🟢 62.5%
app/javascript/Authentication/authenticationManager.ts	🔴 14.89%	🔴 16.33%	🟢 1.44%
app/javascript/Authentication/openid.ts	🔴 0%	🔴 33.33%	🟢 33.33%
app/javascript/Authentication/useLoginRequired.tsx	🔴 0%	🟢 95.83%	🟢 95.83%
app/javascript/ErrorReporting.ts	🔴 5.88%	🔴 30.91%	🟢 25.03%
lib/devise/strategies/legacy_md5_authenticatable.rb	🟠 52.17%	🟠 65.22%	🟢 13.05%
lib/devise/strategies/legacy_sha1_authenticatable.rb	🔴 43.48%	🟠 56.52%	🟢 13.04%
test/controllers/csv_exports_controller_test.rb	🔴 0%	🟢 100%	🟢 100%
test/controllers/oauth_sessions_controller_test.rb	🔴 0%	🟢 100%	🟢 100%
test/controllers/sessions_controller_test.rb	🔴 0%	🟢 100%	🟢 100%
Overall Coverage	🟢 53.53%	🟢 53.79%	🟢 0.26%

Minimum allowed coverage is 0%, this run produced 53.79%