Validate provider for non-PKCE OAuth responses

[samsamtrum]

Summary

Validates the OAuth provider state for non-PKCE popup responses, matching the existing validation already applied to PKCE providers.

Why

parseOAuthResponse(url, expectedProvider) currently rejects PKCE popup responses when the provider in state does not match expectedProvider, but non-PKCE providers only require an id_token.

That means a popup handler expecting Google can accept a hash whose state says another provider, as long as an id_token is present. This can route a mismatched OAuth response through the wrong popup handler.

This change makes non-PKCE validation require both:

• id_token is present
• provider === expectedProvider

and adds a regression test for the mismatch case.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit d109eae:

Sandbox	Source
@turnkey/example-react-components	Configuration