test(oidc): ensure that static-dist is built to validate tests

tests/oidc/oidc.hurl

@@ -109,24 +109,23 @@ header "Location" contains "redirect_uri="
 #          {frontend_url}/login?oidc_code=…
 #
 #          With `location: true` Hurl follows the whole chain and
-#          lands on the SPA login URL. The test server config
-#          (server-with-oidc.env) points `OXICLOUD_STATIC_PATH`
-#          at ./static — which is the legacy vanilla frontend, NOT
-#          static-dist/ — so /login returns 404. That 404 is the
-#          test signal: it proves we landed AT /login (i.e. the
-#          d1bbe8ba contract held). The URL we end at is the
-#          actual assertion.
+#          lands on the SPA login URL. The SvelteKit SPA serves
+#          `/login` from `static-dist/login.html` with 200 — this
+#          is the production contract. The runner (`tests/oidc/run.sh`)
+#          builds `static-dist/` before launching the server so
+#          local and CI both see the production behaviour. Without
+#          that build the route would 404 via the ServeDir fallback.
 #
 #          A pre-d1bbe8ba server would have redirected to
-#          `http://localhost:8087/?oidc_code=…` instead — same
-#          404, but the `landed_at` assertion would catch it.
+#          `http://localhost:8087/?oidc_code=…` instead — the
+#          `landed_at` regex below catches that regardless.
 # ─────────────────────────────────────────────────────────────
 GET {{idp_url}}
 [Options]
 location: true
 location-trusted: true
 
-HTTP 404
+HTTP 200
 [Captures]
 landed_at: url
 oidc_code: url regex "oidc_code=([a-f0-9]+)"
@@ -289,7 +288,9 @@ GET {{relogin_idp_url}}
 location: true
 location-trusted: true
 
-HTTP 404
+# Same contract as Step 4 — the SPA serves /login with 200 (the
+# runner ensures static-dist/ is built before the server starts).
+HTTP 200
 [Captures]
 relogin_oidc_code: url regex "oidc_code=([a-f0-9]+)"
 [Asserts]

tests/oidc/run.sh

@@ -143,6 +143,21 @@ set +a
 source "$COMMON/wipe-storage.sh"
 wipe_storage "$OXICLOUD_STORAGE_PATH"
 
+# ── 3.5. Ensure the SPA is built (static-dist/) ────────────────────────────
+# The OIDC suite's Step 4 + Step 9 walk the full redirect chain and assert
+# they land on `/login?oidc_code=…` with HTTP 200 — the production contract,
+# where the container ships `static-dist/login.html`. Without that bundle
+# `resolve_static_path` falls back to `OXICLOUD_STATIC_PATH=./static`, which
+# was removed in commit 54639d46 — so ServeDir 404s the route and Step 4
+# fails. Build here so local + CI both exercise the production layout.
+DIST_DIR="$REPO_ROOT/static-dist"
+if [[ ! -f "$DIST_DIR/login.html" ]]; then
+  log "Building SvelteKit SPA (static-dist/login.html missing)..."
+  (cd "$REPO_ROOT/frontend" \
+    && npm ci --silent --no-audit --no-fund \
+    && npm run build) || die "Frontend build failed; static-dist/ is required for the OIDC tests"
+fi
+
 # ── 4. Start OxiCloud server with OIDC enabled ─────────────────────────────
 BUILD_TARGET="${BUILD_TARGET:-debug}"
 OXICLOUD_BIN="$REPO_ROOT/target/$BUILD_TARGET/oxicloud"