Crate secrets_auth_oidc 

OIDC auth: interactive authorization-code login for humans and JWT-bearer validation for machine-to-machine callers. Both modes share the same discovery/JWKS cache and claims-to-policies mapping — the only difference is where the JWT to verify comes from (a token-endpoint response vs. handed to us directly).

Structs

OidcAuthMethod

Shared by both OIDC login modes: fetches and caches discovery documents and JWKS per issuer so every login doesn’t round-trip to the IdP.

OidcConfig

Operator-supplied IdP registration. One config for the whole server at v1 — multiple OIDC providers would mean keying this (and STATE_PREFIX) by provider name, deferred until actually needed.