auth fixes

apps/web/src/pages/LoginPage.tsx

@@ -1,16 +1,25 @@
 import { useEffect } from 'react'
-import { createPKCE, storePKCE } from '../auth/oidc'
+import { createPKCE, storePKCE, storeState } from '../auth/oidc'
 
 const OIDC_ISSUER = import.meta.env.VITE_OIDC_ISSUER
 const CLIENT_ID = import.meta.env.VITE_OIDC_CLIENT_ID
 const REDIRECT_URI = import.meta.env.VITE_OIDC_REDIRECT_URI
 
+function generateState(): string {
+  const array = new Uint8Array(32)
+  crypto.getRandomValues(array)
+  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('')
+}
+
 export default function LoginPage() {
   useEffect(() => {
     const initiateLogin = async () => {
       const { verifier, challenge } = await createPKCE()
       storePKCE(verifier)
 
+      const state = generateState()
+      storeState(state)
+
       const params = new URLSearchParams({
         client_id: CLIENT_ID,
         redirect_uri: REDIRECT_URI,
@@ -18,6 +27,7 @@ export default function LoginPage() {
         scope: 'openid profile email',
         code_challenge: challenge,
         code_challenge_method: 'S256',
+        state,
       })
 
       const authorizationEndpoint = 'https://auth.commumedia.org/application/o/authorize/'