feat(makelore): add platform oidc login

electron/main/app-deep-link.ts

@@ -2,8 +2,11 @@ export const NIANCODE_APP_PROTOCOL = 'niancode';
 
 export type NianCodeDeepLink = {
   type: 'desktop-auth-callback';
-  requestId: string;
+  /** Legacy desktop auth callbacks carry a request id. OIDC callbacks use state. */
+  requestId?: string;
   url: string;
+  code?: string;
+  state?: string;
 } | { type: 'cloud-agent'; slug: string; url: string }
   | { type: 'teacher-preview'; draftRevision: number; url: string };
 
@@ -29,6 +32,7 @@ const SENSITIVE_QUERY_KEYS = new Set([
   'device_secret',
   'token',
 ]);
+const AUTH_CALLBACK_QUERY_KEYS = new Set(['request_id', 'code', 'state']);
 
 export function parseNianCodeDeepLinkUrl(rawUrl: string): NianCodeDeepLink | null {
   let url: URL;
@@ -67,15 +71,27 @@ export function parseNianCodeDeepLinkUrl(rawUrl: string): NianCodeDeepLink | nul
     }
   }
 
-  const requestId = url.searchParams.get('request_id')?.trim();
-  if (!requestId || requestId.length > 128) {
+  if ([...url.searchParams.keys()].some((key) => !AUTH_CALLBACK_QUERY_KEYS.has(key))) {
     return null;
   }
 
+  const requestId = url.searchParams.get('request_id')?.trim() || undefined;
+  if (requestId && requestId.length > 128) return null;
+
+  const code = url.searchParams.get('code')?.trim() || undefined;
+  const state = url.searchParams.get('state')?.trim() || undefined;
+  if (Boolean(code) !== Boolean(state) || (code && code.length > 4096) || (state && state.length > 512)) {
+    return null;
+  }
+  // The platform OIDC redirect is registered as niancode://auth/callback and
+  // therefore returns code/state without the legacy request_id parameter.
+  if (!requestId && !(code && state)) return null;
+
   return {
     type: 'desktop-auth-callback',
-    requestId,
+    ...(requestId ? { requestId } : {}),
     url: rawUrl,
+    ...(code ? { code, state } : {}),
   };
 }