Cot OIDC authentication example

This Cot example implements provider-neutral OpenID Connect authentication with the authorization-code flow. It uses provider discovery, PKCE, CSRF state, a nonce, ID-token verification, and optional at_hash verification. It does not call any provider API or rely on provider-specific claims.

Copy the development configuration template, then replace the placeholder values. Register the exact callback URL with the provider. The provider must support OpenID Connect discovery and the authorization-code flow.

Run the server (Cot applies the session-store migration at startup):

cp config/dev.toml.example config/dev.toml
# Edit config/dev.toml, then:
cargo run

The example deliberately keeps authenticated users in memory. Replace the HashMap in src/auth/backend.rs with the application's user repository before using it in production; after a restart, existing authenticated sessions cannot be restored by this example backend.