[Bccorb]

What

Makes the four OpenID Provider system config keys writable: oidc_provider_enabled, oidc_issuer, allow_client_secrets, and third_party_clients_enabled move from NOT_YET_WRITABLE to WRITABLE_KEYS, so seamless config set and config apply send them. NOT_YET_WRITABLE stays (now empty) with its test, so the next types bump that adds a key still fails until it is placed.

Why

The instance's patch schema is strict, so these keys stayed unsent until an auth API accepted them. The API that does is merged on main and ships in auth API 0.21.0, so this PR needs auth API 0.21.0; against an older instance config set on one of these keys is refused by the instance.

Values

• oidc_provider_enabled, allow_client_secrets, third_party_clients_enabled parse as JSON booleans; oidc_issuer takes a URL, or null to clear it. These match SystemConfigPatchSchema (z.boolean().optional() and z.url().nullable().optional()).
• config set checks the four values against the shared patch schema fields before sending, so config set oidc_provider_enabled yes fails with "oidc_provider_enabled must be true or false." rather than the instance's 400. config apply leaves validation to the instance, as it does for every other key.
• Whether the provider can be enabled depends on the stored oidc_issuer, rpid, and signing keys, which only the instance knows, so that rule stays on the instance and is documented rather than checked.

Docs

seamless config --help and the README document the keys: the instance refuses to enable the provider until oidc_issuer is set, allow_client_secrets enables the weaker shared-secret client authentication and seamless clients refuses shared-secret clients until it is on, and third-party clients need third_party_clients_enabled.

Bumps @seamless-auth/types to 0.34.0-next.3. Minor changeset.

Closes #332

Checks

• npm run build: passes
• npm run coverage: 76 files passed, 1 skipped; 1698 tests passed, 4 skipped; thresholds met (all files 99.04% statements, 96.68% branches, 98.68% functions, 99.31% lines)
• npm run check:types-current: @seamless-auth/types "0.34.0-next.3" is current
• npm run check:pins: passes