feat: overhaul oidc work

config.example.yaml

@@ -136,6 +136,18 @@ integration:
 # (This is optional, but recommended for the best experience)
 oidc:
   issuer: "https://accounts.google.com"
+
+  # If your OIDC provider does not support discovery (does not have the URL at
+  # `/.well-known/openid-configuration`), you need to manually set endpoints.
+  # This also works to override endpoints if you so desire or if your OIDC
+  # discovery is missing certain endpoints (ie GitHub).
+  # For some typical providers, see the documentation.
+
+  # authorization_endpoint: ""
+  # token_endpoint: ""
+  # userinfo_endpoint: ""
+
+  # The client ID for the OIDC client
   client_id: "your-client-id"
 
   # The client secret for the OIDC client
@@ -146,6 +158,9 @@ oidc:
   # with systemd's `LoadCredential` straightforward:
   # client_secret_path: "${CREDENTIALS_DIRECTORY}/oidc_client_secret"
 
+  # Defaults to 'openid email profile'
+  # scope: "openid email profile"
+
   disable_api_key_login: false
   token_endpoint_auth_method: "client_secret_post"
 
@@ -166,3 +181,9 @@ oidc:
   # we go to fetch the userinfo endpoint. Optionally, this can be set to
   # "oidc" or "gravatar" as of 0.6.1.
   # profile_picture_source: "gravatar"
+
+  # Extra query parameters can be passed to the authorization endpoint
+  # by setting them here. This is useful for providers that require any kind
+  # of custom hinting.
+  # extra_params:
+  #   prompt: "select_account" # Example: force account selection on Google