fix(openiddict): restore OAuth endpoints in dashboard and swagger

modules/Dashboard/src/SimpleModule.Dashboard/Pages/components/TokenTester.tsx

@@ -121,7 +121,7 @@ export function TokenTester() {
       response_type: 'code',
       client_id: 'simplemodule-client',
       redirect_uri: `${window.location.origin}/oauth-callback`,
-      scope: 'openid profile email',
+      scope: 'openid profile email roles',
       state,
       code_challenge: challenge,
       code_challenge_method: 'S256',

modules/OpenIddict/src/SimpleModule.OpenIddict.Contracts/OpenIddictModuleConstants.cs

@@ -12,7 +12,7 @@ public static class Routes
         public const string ClientsCreate = "/clients/create";
         public const string ClientsEdit = "/clients/{id}/edit";
 
-        // View route — registered via ConfigureEndpoints (escape hatch)
+        // OAuth callback (registered as a top-level IEndpoint, not under ViewPrefix)
         public const string OAuthCallback = "/oauth-callback";
 
         // Connect routes (also in ConnectRouteConstants)

modules/OpenIddict/src/SimpleModule.OpenIddict/Endpoints/Connect/OAuthCallbackEndpoint.cs

@@ -0,0 +1,17 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Routing;
+using SimpleModule.Core;
+using SimpleModule.Core.Inertia;
+using SimpleModule.OpenIddict.Contracts;
+
+namespace SimpleModule.OpenIddict.Endpoints.Connect;
+
+[AllowAnonymous]
+public class OAuthCallbackEndpoint : IEndpoint
+{
+    public const string Route = OpenIddictModuleConstants.Routes.OAuthCallback;
+
+    public void Map(IEndpointRouteBuilder app) =>
+        app.MapGet(Route, () => Inertia.Render("OpenIddict/OAuthCallback"));
+}

modules/OpenIddict/src/SimpleModule.OpenIddict/Hosting/OpenIddictSwaggerContributor.cs

@@ -33,6 +33,7 @@ public void Configure(SwaggerGenOptions options)
                             { AuthConstants.OpenIdScope, "OpenID" },
                             { AuthConstants.ProfileScope, "Profile" },
                             { AuthConstants.EmailScope, "Email" },
+                            { AuthConstants.RolesScope, "Roles" },
                         },
                     },
                 },
@@ -55,6 +56,7 @@ public void Configure(SwaggerGenOptions options)
                         AuthConstants.OpenIdScope,
                         AuthConstants.ProfileScope,
                         AuthConstants.EmailScope,
+                        AuthConstants.RolesScope,
                     ]
                 },
             };

modules/OpenIddict/src/SimpleModule.OpenIddict/OpenIddictModule.cs

@@ -1,13 +1,10 @@
-using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Routing;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using SimpleModule.Core;
 using SimpleModule.Core.Authorization;
 using SimpleModule.Core.Hosting;
-using SimpleModule.Core.Inertia;
 using SimpleModule.Database;
 using SimpleModule.OpenIddict.Contracts;
 using SimpleModule.OpenIddict.Hosting;
@@ -118,12 +115,5 @@ public void ConfigureServices(IServiceCollection services, IConfiguration config
         OpenIddictAuthSetup.AddSmartAuthentication(services);
     }
 
-    public void ConfigureEndpoints(IEndpointRouteBuilder endpoints)
-    {
-        endpoints
-            .MapGet("/oauth-callback", () => Inertia.Render("OpenIddict/OAuthCallback"))
-            .AllowAnonymous();
-    }
-
     // Menu items removed — accessible via Admin hub page
 }

packages/SimpleModule.Client/src/routes.ts

@@ -312,6 +312,7 @@ export const routes = {
     api: {
       authorization: () => '/connect/authorize' as const,
       logout: () => '/connect/endsession' as const,
+      oAuthCallback: () => '/oauth-callback' as const,
       token: () => '/connect/token' as const,
       userinfo: () => '/connect/userinfo' as const,
     },