fix: handle missing OIDC auth request gracefully

The GET /login route called getAuthRequest() without error handling.
When a request arrived with an expired or invalid authRequest ID, the
Zitadel OIDC service returned a NOT_FOUND gRPC error that propagated
as an unhandled ConnectError, crashing the route handler with a 500.

Wrap the call in try/catch and add a null guard, returning a 400 JSON
response instead. This matches the existing pattern used by the SAML
branch which already checks for a missing samlRequest.

Made-with: Cursor

Author: mattdjenkinson

apps/login/src/app/login/route.ts

@@ -134,10 +134,26 @@ export async function GET(request: NextRequest) {
 
   // continue with OIDC
   if (requestId && requestId.startsWith("oidc_")) {
-    const { authRequest } = await getAuthRequest({
-      serviceUrl,
-      authRequestId: requestId.replace("oidc_", ""),
-    });
+    let authRequest;
+    try {
+      ({ authRequest } = await getAuthRequest({
+        serviceUrl,
+        authRequestId: requestId.replace("oidc_", ""),
+      }));
+    } catch (error) {
+      console.error("Failed to get auth request:", error);
+      return NextResponse.json(
+        { error: "Auth request not found or expired" },
+        { status: 400 },
+      );
+    }
+
+    if (!authRequest) {
+      return NextResponse.json(
+        { error: "Auth request not found" },
+        { status: 400 },
+      );
+    }
 
     let organization = "";
     let suffix = "";