Add CSRF-safe tenant identity administration

src/user_engine/oidc.py

@@ -23,6 +23,7 @@ class PendingLogin:
 class BrowserSession:
     claims: Mapping[str, Any]
     expires_at: float
+    csrf_token: str = ""
 
 
 class OIDCClient:
@@ -88,7 +89,11 @@ class OIDCClient:
         claims = self._verify(token)
         session_id = secrets.token_urlsafe(32)
         expiry = min(float(claims.get("exp", time.time() + self.session_ttl)), time.time() + self.session_ttl)
-        self.sessions[session_id] = BrowserSession(claims=claims, expires_at=expiry)
+        self.sessions[session_id] = BrowserSession(
+            claims=claims,
+            expires_at=expiry,
+            csrf_token=secrets.token_urlsafe(32),
+        )
         self._prune()
         return session_id
 
@@ -102,6 +107,13 @@ class OIDCClient:
     def logout(self, session_id: str) -> None:
         self.sessions.pop(session_id, None)
 
+    def csrf_token(self, session_id: str) -> str | None:
+        session = self.sessions.get(session_id)
+        if session is None or session.expires_at <= time.time():
+            self.sessions.pop(session_id, None)
+            return None
+        return session.csrf_token
+
     def _verify(self, token: str) -> Mapping[str, Any]:
         if not token:
             raise ValueError("OIDC token response is missing a token")