OIDC-Integration: Keycloak-Login (Authorization Code Flow + PKCE), app-seitige Rollen bleiben unangetastet

backend/migrations.js

@@ -218,6 +218,17 @@ async function initDatabase() {
     : `CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads(user_id)`
   );
 
+  // OIDC: stabile Provider-Identität (claims.sub) pro User speichern.
+  // UNIQUE verhindert, dass zwei User denselben Provider-Account beanspruchen.
+  await migrate('add_users_oidc_sub', isPostgres
+    ? `ALTER TABLE users ADD COLUMN IF NOT EXISTS oidc_sub TEXT`
+    : `ALTER TABLE users ADD COLUMN oidc_sub TEXT`
+  );
+  await migrate('idx_users_oidc_sub', isPostgres
+    ? `CREATE UNIQUE INDEX IF NOT EXISTS idx_users_oidc_sub ON users(oidc_sub) WHERE oidc_sub IS NOT NULL`
+    : `CREATE UNIQUE INDEX IF NOT EXISTS idx_users_oidc_sub ON users(oidc_sub) WHERE oidc_sub IS NOT NULL`
+  );
+
   console.log('Datenbanktabellen initialisiert.');
 }