feat(oidc): cy oidc group-mapping + org-settings commands

[fhacloid]

What

Adds OIDC group→team mapping CRUD and per-organization OIDC reconciliation settings to the CLI, under a new cy beta oidc command group, plus the middleware methods that back them.

This is the CLI half of a synced pair with terraform-provider-cycloid — the TF provider consumes these middleware methods (see the paired PR). Goal: make the PROD-303 OIDC group-mapping feature scriptable for end-to-end testing / automation.

Commands

cy beta oidc mappings list
cy beta oidc mappings create  --group-name <claim>  --team <team-canonical>
cy beta oidc mappings delete  --mapping-id <id>
cy beta oidc settings get
cy beta oidc settings set     [--oidc-managed] [--no-match-policy keep_membership|eject] [--default-role <role>]

settings set is read-merge-write: only the flags you pass are changed, so an unset flag never silently resets live state (the backend endpoint is a full-replace PUT). A not-yet-configured org (404 on read) starts from defaults.

Middleware

New methods on the Middleware interface (cmd/cycloid/middleware/organization_oidc.go), all via GenericRequest:

• ListOIDCGroupMappings, CreateOIDCGroupMapping, DeleteOIDCGroupMapping
• GetOIDCOrganizationSettings, UpdateOIDCOrganizationSettings

The OIDC request/response types live in the middleware package (not client/models) because these endpoints are not in the published swagger spec yet — so no client/models regen and no network codegen. models.Role is reused for the mapped team's roles.

Backend contract

Targets /organizations/{org}/oidc-group-mappings and /organizations/{org}/oidc-organization-settings (PROD-303 backend, currently on the meta-gm-rescope branch). A mapping is one (group_name, team_canonical) pair (a group granting several teams = several mappings). oidc_no_match_policy=eject requires oidc_managed=true (API returns 422 otherwise).

Tests

e2e/oidc_test.go — full mappings CRUD + settings round-trip, following the existing teams_test.go pattern (requires a live backend; runs in CI / make test).

Verification (offline, on this branch)

• go build ./... — ✓
• go vet ./cmd/... ./internal/... ./e2e/... — ✓
• golangci-lint run ./cmd/cycloid/beta/oidc/... — 0 issues
• gofmt — clean
• e2e not run here (needs a backend) — ships for CI.

Status

Draft — beta command group; lands alongside the PROD-303 backend endpoints. Paired with the terraform-provider-cycloid OIDC PR, which depends on the Middleware methods added here.

---

Update — cy beta oidc integration (SSO config) + secret-redaction hardening

Added a third subcommand group: cy beta oidc integration {get,set} to configure the org's AuthenticationOIDC SSO integration — issuer, client_id/secret, discovery_url (split-network), session TTL, groups claim, CA cert, TLS/discovery toggles (full config parity). Backed by new GetOIDCIntegration / UpdateOIDCIntegration middleware methods.

• set is read-merge-write: sends type+enabled+only-the-changed keys; the backend merge preserves untouched config and the stored secret (an absent/empty secret is never blanked — secret rotation requires a non-empty value).
• Secret via --client-secret or CY_OIDC_CLIENT_SECRET (env form is the documented default — keeps it out of shell history); CA cert via --ca-cert / CY_OIDC_CA_CERT.
• get never exposes the secret (has_secret / has_ca_certificate booleans only).
• Secret-redaction hardening: the debug/error body sanitizer now redacts oidc_client_secret / oidc_ca_cert and any *_secret / *_ca_cert field, so secrets never reach DEBUG-verbosity (CY_TEST_VERBOSITY=debug) logs. New cases in sanitize_test.go. (A security pass caught that the suffix safety-net wasn't wired into sanitizeValue — fixed.)

Verified offline: build + vet + golangci-lint ./cmd/cycloid/middleware/... ./cmd/cycloid/beta/oidc/... = 0 issues + gofmt clean.

[fhacloid]

Paired Terraform PR: cycloidio/terraform-provider-cycloid#102 — consumes the Middleware OIDC methods added here. Merge this first, then un-draft #102 (drop its local replace, bump cycloid-cli to the merged SHA).