Fix Keycloak OIDC flow (calcom#27716)

Some OIDC providers like Keycloak (v18+) include an `iss` (issuer) parameter in the authentication response for security (as per RFC 9207). The oidc route was explicitly extracting only `code` and `state`, thus losing the `iss` parameter and other potential parameters like `session_state`. When Jackson passed the incomplete set of parameters to `openid-client`, the library failed validation with the error `invalid response encountered` because it expected the `iss` parameter to be present if the server supports it.

Fixes calcom#22238.

Co-authored-by: Sahitya Chandra <sahityajb@gmail.com>

Author: richardhj

apps/web/app/api/auth/oidc/route.ts

@@ -9,20 +9,18 @@ import logger from "@calcom/lib/logger";
 // This is the callback endpoint for the OIDC provider
 // A team must set this endpoint in the OIDC provider's configuration
 async function handler(req: NextRequest) {
-  const log = logger.getSubLogger({ prefix: ["[ODIC auth]"] });
+  const log = logger.getSubLogger({ prefix: ["[OIDC auth]"] });
   const { searchParams } = req.nextUrl;
-  const code = searchParams.get("code");
-  const state = searchParams.get("state");
-  const tenant = searchParams.get("tenant");
+  const params = Object.fromEntries(searchParams.entries());
 
-  if (!code || !state) {
+  if (!params.code || !params.state) {
     return NextResponse.json({ message: "Code and state are required" }, { status: 400 });
   }
 
   const { oauthController } = await jackson();
 
   try {
-    const { redirect_url } = await oauthController.oidcAuthzResponse({ code, state });
+    const { redirect_url } = await oauthController.oidcAuthzResponse(params);
 
     if (!redirect_url) {
       throw new HttpError({
@@ -33,7 +31,7 @@ async function handler(req: NextRequest) {
 
     return NextResponse.redirect(redirect_url, 302);
   } catch (err) {
-    log.error(`Error authorizing tenant ${tenant}: ${err}`);
+    log.error(`Error authorizing tenant ${params.tenant}: ${err}`);
     const { message, statusCode = 500 } = err as HttpError;
 
     return NextResponse.json({ message }, { status: statusCode });