Expand portal onboarding and administration

src/user_engine/oidc.py

@@ -48,13 +48,13 @@ class OIDCClient:
         self.pending: dict[str, PendingLogin] = {}
         self.sessions: dict[str, BrowserSession] = {}
 
-    def begin(self) -> str:
+    def begin(self, *, tenant_hint: str | None = None) -> str:
         state = secrets.token_urlsafe(32)
         verifier = secrets.token_urlsafe(64)
         challenge = _b64(hashlib.sha256(verifier.encode("ascii")).digest())
         self.pending[state] = PendingLogin(verifier=verifier, created_at=time.time())
         self._prune()
-        return f"{self.issuer}/authorize?{urlencode({
+        parameters = {
             'response_type': 'code',
             'client_id': self.client_id,
             'redirect_uri': self.redirect_uri,
@@ -62,7 +62,10 @@ class OIDCClient:
             'state': state,
             'code_challenge': challenge,
             'code_challenge_method': 'S256',
-        })}"
+        }
+        if tenant_hint:
+            parameters["tenant_hint"] = tenant_hint
+        return f"{self.issuer}/authorize?{urlencode(parameters)}"
 
     def complete(self, *, code: str, state: str) -> str:
         pending = self.pending.pop(state, None)