Show why personal OIDC logins are refused

Personal Google and Microsoft accounts were rejected with a raw
JSON unauthorized response after the OIDC callback. Redirect to a
dedicated auth page that explains the enterprise-account
requirement, and check enterprise eligibility before xms_edov so
Microsoft consumer accounts get the same clear error.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/iam/oidc/service_test.go

@@ -21,6 +21,7 @@
 package oidc
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -89,3 +90,65 @@ func TestIsEmailDomainOwnerVerified(t *testing.T) {
 		)
 	}
 }
+
+func TestValidateIDTokenClaims_PersonalAccounts(t *testing.T) {
+	t.Parallel()
+
+	s := newTestService(t)
+
+	t.Run("rejects Google personal account without hosted domain", func(t *testing.T) {
+		t.Parallel()
+
+		err := validateIDTokenClaims(
+			s.providers[coredata.OIDCProviderGoogle],
+			&idTokenClaims{
+				Email:         "user@gmail.com",
+				EmailVerified: true,
+			},
+		)
+		_, ok := errors.AsType[*ErrPersonalAccountNotAllowed](err)
+		assert.True(t, ok, "got %T: %v", err, err)
+	})
+
+	t.Run("rejects Microsoft personal account before xms_edov check", func(t *testing.T) {
+		t.Parallel()
+
+		err := validateIDTokenClaims(
+			s.providers[coredata.OIDCProviderMicrosoft],
+			&idTokenClaims{
+				Issuer: "https://login.microsoftonline.com/" + microsoftConsumerTenantID + "/v2.0",
+				Email:  "user@outlook.com",
+			},
+		)
+		_, ok := errors.AsType[*ErrPersonalAccountNotAllowed](err)
+		assert.True(t, ok, "got %T: %v", err, err)
+	})
+
+	t.Run("accepts Google Workspace account with hosted domain", func(t *testing.T) {
+		t.Parallel()
+
+		err := validateIDTokenClaims(
+			s.providers[coredata.OIDCProviderGoogle],
+			&idTokenClaims{
+				Email:         "user@acme.com",
+				EmailVerified: true,
+				HostedDomain:  "acme.com",
+			},
+		)
+		assert.NoError(t, err)
+	})
+
+	t.Run("rejects Microsoft enterprise account missing xms_edov", func(t *testing.T) {
+		t.Parallel()
+
+		err := validateIDTokenClaims(
+			s.providers[coredata.OIDCProviderMicrosoft],
+			&idTokenClaims{
+				Issuer: "https://login.microsoftonline.com/tenant-id/v2.0",
+				Email:  "user@acme.com",
+			},
+		)
+		_, ok := errors.AsType[*ErrEmailNotVerified](err)
+		assert.True(t, ok, "got %T: %v", err, err)
+	})
+}