From 37530dc5339a02d675243de2e3afae33e49afbc8 Mon Sep 17 00:00:00 2001
From: Jennie Robinson Faber <jennie@jenniefaber.com>
Date: Wed, 24 Jun 2026 17:50:19 +0100
Subject: [PATCH] OIDC: register coop.cool as a second client (Curated Learn
 admin)

Adds a coop-cool relying party alongside outline-wiki so the coop.cool
Curated Learn admin can authenticate against this provider. Redirect URIs
cover coop.cool prod + the local dev callback (:3004). The client secret
comes from COOP_COOL_OIDC_CLIENT_SECRET and must match coop.cool's
OIDC_CLIENT_SECRET.
---
 server/utils/oidc-provider.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/server/utils/oidc-provider.ts b/server/utils/oidc-provider.ts
index 187f8a8..f17db22 100644
--- a/server/utils/oidc-provider.ts
+++ b/server/utils/oidc-provider.ts
@@ -43,6 +43,20 @@ export async function getOidcProvider() {
         response_types: ["code"],
         token_endpoint_auth_method: "client_secret_post",
       },
+      {
+        // coop.cool — second relying party. Curated Learn admin signs in here.
+        client_id: process.env.COOP_COOL_OIDC_CLIENT_ID || "coop-cool",
+        client_secret: process.env.COOP_COOL_OIDC_CLIENT_SECRET || "",
+        redirect_uris: [
+          "https://coop.cool/auth/callback",
+          // Local development callback (coop.cool dev server runs on :3004)
+          "http://localhost:3004/auth/callback",
+        ],
+        post_logout_redirect_uris: ["https://coop.cool", "http://localhost:3004"],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "client_secret_post",
+      },
     ],
 
     claims: {