Complete OIDC Auth Implementation

[coldham10]

Hello,

I've been working on a Supabase project to provide federated signin via my Keycloak server via OIDC/OAuth2.0, which Supabase ostensibly supports. After starting the project and getting into the weeds however, it seems that the Supabase implementation is at best incomplete, which has been rather frustrating.

For example

• Supabase Auth returns provider_token and provider_refresh_token which are stored in session cookies, but these are mysteriously overwritten and never refreshed when setSession is called, or seemingly at random? The docs seem contradictory as to whether this hasn't been implemented 'yet' or never will be.
• Documentation is severely lacking on how to actually handle third party integration in practice. All github issues so far seem to just say its "your responsibility" with no guidance on how to take said responsibility
• Supabase logout doesn't log out of the federated provider - why not?

It seems several aspects of the implementation and/or documentation is simply incomplete for this supposed feature, and any GitHub issues and discussions only seem to get rather snide responses from supabase, with no actual guidance on where "it's your responsibility" starts, and how to handle the next steps for federating with OIDC. It would be very useful to either have an indication of whether this functionality will ever be completed, or at least some better documentation about how to proceed beyond the edge of what has been implemented already