PKCE frontend authentication

[nbudin]

Summary

• Implements PKCE-based OAuth authentication flow entirely in the frontend, removing dependency on server-side session management for convention subdomain auth
• Replaces the in-app authentication modal with direct redirects to Devise pages hosted on the root site (sign in, sign up, forgot password), rendered in the CMS layout as React components
• Ports user con profile setup and clickwrap redirect logic to JavaScript (previously server-side before_actions that don't fire in the PKCE flow); profile creation and destination routing now happen in the React Router loader before any rendering, eliminating flash-of-content

Key changes

• authenticationManager: fetches client configuration (OIDC issuer, client ID) via GraphQL; manages PKCE state and token refresh via JWT bearer tokens
• SessionsController / RegistrationsController / PasswordsController: render app shell for Devise form routes; SessionsController#create allows cross-host redirect back to trusted convention domains after sign-in
• SignInButton / SignUpButton: initiate OAuth PKCE flow rather than opening a modal; sign-up navigates to /users/sign_up?user_return_to=<oauthUrl> so the user lands back at the convention after registration
• appRootLoader: calls setupMyProfile mutation when no profile exists, then redirects to clickwrap agreement or profile setup page as needed — no flash of content
• SetupMyProfile GraphQL mutation: creates a UserConProfile for the current user via SetupUserConProfileService, idempotent (returns existing profile if one already exists)

Test plan

• Sign in via root site — should redirect back to convention and be authenticated
• Sign out from convention — should redirect back to convention home page
• Sign up as new user on a convention with a clickwrap agreement — should land on clickwrap, then profile setup
• Sign up as new user on a convention without a clickwrap — should land directly on profile setup
• Return visit with needs_update: true profile — should redirect to profile setup
• Forgot password flow — should render in CMS layout, work end-to-end

🤖 Generated with Claude Code

[github-actions]

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
app/controllers/application_controller.rb	🟠 60%	🟠 58.33%	🔴 -1.67%
app/graphql/graphql_operation.rb	🟢 100%	🟢 92.86%	🔴 -7.14%
app/graphql/mutations/setup_my_profile.rb	🔴 0%	🟠 54.55%	🟢 54.55%
app/graphql/types/client_configuration_type.rb	🟠 72.73%	🟢 100%	🟢 27.27%
app/graphql/types/query_type.rb	🟢 78.05%	🟠 71.53%	🔴 -6.52%
app/graphql/types/user_con_profile_type.rb	🟢 78.86%	🟢 79.03%	🟢 0.17%
app/javascript/Authentication/authenticationManager.ts	🔴 0%	🔴 23.08%	🟢 23.08%
app/javascript/Authentication/mutations.generated.ts	🔴 0%	🟢 100%	🟢 100%
app/javascript/useIntercodeApolloClient.ts	🔴 22.5%	🔴 20.45%	🔴 -2.05%
app/models/root_site.rb	🟠 58.06%	🟠 59.38%	🟢 1.32%
app/presenters/cms_rendering_context.rb	🟢 83.33%	🟢 82.76%	🔴 -0.57%
app/services/cms_content_finder.rb	🟢 86.36%	🟢 80.77%	🔴 -5.59%
config/initializers/cors.rb	🟠 50%	🔴 47.06%	🔴 -2.94%
config/initializers/doorkeeper.rb	🟢 85.19%	🟠 72.41%	🔴 -12.78%
lib/intercode/liquid/tags/app_component_renderer.rb	🟠 62.5%	🟠 69.23%	🟢 6.73%
Overall Coverage	🟢 53.09%	🟢 52.84%	🔴 -0.25%

Minimum allowed coverage is 0%, this run produced 52.84%