Add ODIC Back-Channel Logout (#304)

* prevent returning expired sessions

* add issuer to ODIC creds

* get id token in ODIC

* make session signin return session

* working backchannel logout?

* require https for ODIC provider

* handle wellknown not being https

* find session api progress

* fix windows build

* return session token on session

* switch OIDC to #searchSessions

* update pnpm

* switch to using message on error obj

* move odic callback

* fix type errors

* redirect old oidc callback

* make redirect url a URL

* remove scheduled task downloadCleanup

* fix session search for oidc

* fix signin result

* cleanup code

* ignore data dir

* fix lint error

server/internal/config/sys-conf.ts

@@ -10,8 +10,9 @@ class SystemConfig {
     process.env.EXTERNAL_URL ?? "http://localhost:3000",
     { stripWWW: false },
   );
-  private dropVersion;
-  private gitRef;
+  private dropVersion: string;
+  private gitRef: string;
+  private odicRequireHttps;
 
   private checkForUpdates = getUpdateCheckConfig();
 
@@ -20,6 +21,17 @@ class SystemConfig {
     const config = useRuntimeConfig();
     this.dropVersion = config.dropVersion;
     this.gitRef = config.gitRef;
+
+    const odicRequireHttps = process.env.OIDC_REQUIRE_HTTPS as
+      | string
+      | undefined;
+
+    // default to true if not set
+    this.odicRequireHttps =
+      odicRequireHttps !== undefined &&
+      odicRequireHttps.toLocaleLowerCase() === "false"
+        ? false
+        : true;
   }
 
   getLibraryFolder() {
@@ -49,6 +61,11 @@ class SystemConfig {
   getExternalUrl() {
     return this.externalUrl;
   }
+
+  // if oidc should require https for endpoints
+  shouldOidcRequireHttps() {
+    return this.odicRequireHttps;
+  }
 }
 
 export const systemConfig = new SystemConfig();