feat: /tokens endpoint

[balazsorban44]

What:
The goal of this PR is to create a new /tokens endpoint, that the users can call, and if they have a valid session, the access_token will be returned. In the case of OpenID Connect (OIDC) compliant providers, we can also try to keep that token fresh, by doing using a refresh token

We can also add a new hook useAccessToken, to provide users a nice API to retrieve an access token, without needing to configure the jwt and session callbacks

Why:
One of the most popular usages of the jwt and session callbacks are to put an access_token in the session cookie, so the users can do client-side calls to protected APIs.

How:

This will be a new /tokens endpoint. The access_token will be saved into its own cookie by default (along with the refresh_token and expiry date), to mitigate the 4096bytes limit common browser use. This way, the session cookie will free up enough space for the users to save even more stuff there about the user, if they wish.

As of v4, this is irrelevant as we implement cookie chunking (if the session is larger than 4096 bytes, we split it into multiple cookies and merge them when reading.)

Checklist:

• Documentation
• Tests
• Ready to be merged

NOTE ⚠ This is highly experimental add this moment, the tokens are not even encrypted in the cookies, which could be a major security issue. DO NOT USE THIS IN PRODUCTION.

This is a continuation of #513

In addition to the above mentioned access_token and refresh_token cookie, it will also save the id_token in a separate cookie, that can be used when logging out of OIDC providers. This will make it possible to do federated logout

[viniciuscr]

pkce does not have a secret, may need some others params also

[balazsorban44]

Going to come back to this at a later point. A lot of bigger changes are being made currently, that need to be done first.

[frrr1]

Hi @balazsorban44!

I appreciate your work on this topic very much, your snippets are of great value. We are currently facing issues when logging out (using oauth/oidc with keycloak 12.0.2, next 10.2.0 and next-auth 3.23.1).

The problem is, that logging out does not quit the keycloak session, so when executing signIn() again, the user is logged in without the need to provide credentials/authenticate.

Considering your comment

"In addition to the above mentioned access_token and refresh_token cookie, it will also save the id_token in a separate cookie, that can be used when logging out of OIDC providers. This will make it possible to do federated logout"

could you advise any workaround until the new features will be merged?

[balazsorban44]

Thank you @frrr1 . More info about federated logout here: #836

But if you only want to force the user to prompt the user with a login screen, check out the {prompt: "login"} option.
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Pass it as the signIn method's third argument.

Note, the previous user will still be logged in on the computer, but the new one will be forced to give their credentials. So I guess depending on your situation this should be fine, or not acceptable (if computers are shared or the users don't trust each other)