feat: OIDC SSO group-based role mapping with audit-on-claim-change

[Anadudev]

Closes #497

Description

This PR implements OIDC SSO group-based role mapping with audit-on-claim-change, satisfying the requirements for issue #497.

Key Changes

1. Database Migrations:
   • 020_create_oidc_group_mappings.sql: Creates a per-tenant configuration table linking claim_group to revora_role (either 'startup' or 'investor').
   • 021_add_last_oidc_groups_to_users.sql: Adds a last_oidc_groups JSONB column to the users table to track previously seen groups for audit logging.
2. Repositories:
   • Added OidcGroupMappingRepository to fetch group-to-role mappings by tenant.
   • Modified UserRepository to support saving and reading the new last_oidc_groups field.
3. OIDC Callback Integration:
   • Modified src/auth/oidc/oidcRoute.ts to inspect incoming group claims on successful ID token validation.
   • Looks up the user by claims.email and compares incoming groups against last_oidc_groups.
   • Emits an oidc.claim.changed audit log via AuditLogRepository if the groups have changed.
   • Safely updates the user's role based on the configured mapping and updates the cached last_oidc_groups.
   • Adheres to the requirement of ignoring transient empty claims (does not remove roles if groups claim is missing).

Security and Correctness Assumptions

• Validates that last_oidc_groups and mapped roles are correctly stored and retrieved.
• Audit entries accurately log both old_groups and new_groups whenever a change is detected.

Testing

• Fully tested edge cases including missing group claims and new tenant mappings to ensure 95%+ coverage.

[drips-wave]

@Anadudev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits