fix!: do not allow insecure oauth requests by default (#27844)

* fix!: do not allow insecure oauth requests by default

* fix: format

* fix: make open-api

* fix: tests

* nit: casing

* chore: migration to allow insecure if current oauth uses http

server/src/schema/migrations/1776332807985-SetOAuthAllowInsecureRequests.ts

@@ -0,0 +1,22 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = jsonb_set(
+      value,
+      '{oauth,allowInsecureRequests}',
+      'true'::jsonb
+    )
+    WHERE key = 'system-config'
+    AND value->'oauth'->>'issuerUrl' LIKE 'http://%'
+  `.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = value #- '{oauth,allowInsecureRequests}'
+    WHERE key = 'system-config'
+  `.execute(db);
+}