Add COMPLIANCE_PORTAL OIDC provider type

Register the new provider enum value so compliance portal OAuth
clients can be stored and resolved like other IAM OIDC providers.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/coredata/migrations/20260713T140201Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE iam_oidc_provider ADD VALUE 'COMPLIANCE_PORTAL';

pkg/coredata/oauth2_client.go

@@ -479,6 +479,7 @@ INSERT INTO iam_oauth2_clients (
 ON CONFLICT (external_client_id) WHERE external_client_id IS NOT NULL DO UPDATE SET
 	client_name = EXCLUDED.client_name,
 	redirect_uris = EXCLUDED.redirect_uris,
+	scopes = EXCLUDED.scopes,
 	grant_types = EXCLUDED.grant_types,
 	response_types = EXCLUDED.response_types,
 	token_endpoint_auth_method = EXCLUDED.token_endpoint_auth_method,

pkg/coredata/oidc_provider.go

@@ -30,6 +30,7 @@ type OIDCProvider string
 const (
 	OIDCProviderGoogle           OIDCProvider = "GOOGLE"
 	OIDCProviderMicrosoft        OIDCProvider = "MICROSOFT"
+	OIDCProviderCompliancePortal OIDCProvider = "COMPLIANCE_PORTAL"
 )
 
 var (
@@ -42,6 +43,7 @@ func OIDCProviders() []OIDCProvider {
 	return []OIDCProvider{
 		OIDCProviderGoogle,
 		OIDCProviderMicrosoft,
+		OIDCProviderCompliancePortal,
 	}
 }
 
@@ -49,7 +51,8 @@ func (v OIDCProvider) IsValid() bool {
 	switch v {
 	case
 		OIDCProviderGoogle,
-		OIDCProviderMicrosoft:
+		OIDCProviderMicrosoft,
+		OIDCProviderCompliancePortal:
 		return true
 	}