Add session transfer for SSO cookies on custom domains

After OIDC login, if the redirect targets a trust center custom
domain, the callback now redirects through a session-transfer
endpoint on that domain. The endpoint verifies an HMAC-signed,
time-limited token and sets the session cookie on the custom
domain before redirecting to the final URL.

The continue URL is bound into the signed token payload to
prevent open-redirect attacks via parameter tampering.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/authn/session_transfer_test.go

@@ -0,0 +1,73 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package authn
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSignAndVerifySessionTransfer(t *testing.T) {
+	t.Parallel()
+
+	secret := "test-secret-key"
+	sessionID := "ses_abc123"
+	continueURL := "https://custom.example.com/compliance"
+
+	token, err := SignSessionTransfer(sessionID, continueURL, secret)
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	claims, err := VerifySessionTransfer(token, secret)
+	require.NoError(t, err)
+	assert.Equal(t, sessionID, claims.SessionID)
+	assert.Equal(t, continueURL, claims.ContinueURL)
+}
+
+func TestVerifySessionTransfer_WrongSecret(t *testing.T) {
+	t.Parallel()
+
+	token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret-a")
+	require.NoError(t, err)
+
+	_, err = VerifySessionTransfer(token, "secret-b")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestVerifySessionTransfer_TamperedToken(t *testing.T) {
+	t.Parallel()
+
+	token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret")
+	require.NoError(t, err)
+
+	_, err = VerifySessionTransfer(token+"x", "secret")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestVerifySessionTransfer_MalformedToken(t *testing.T) {
+	t.Parallel()
+
+	_, err := VerifySessionTransfer("not-a-valid-token", "secret")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestSignSessionTransfer_EmptySecret(t *testing.T) {
+	t.Parallel()
+
+	_, err := SignSessionTransfer("ses_abc123", "https://example.com", "")
+	assert.Error(t, err)
+}