fix(auth): fall back to the verified access token for the tenant claim

Zitadel does not always copy urn:zitadel:iam:org:id into the id_token; the
access token always carries it. Verify that token (issuer) before trusting its
tenant.

app/api/auth/callback/route.ts

@@ -50,8 +50,8 @@ export async function GET(request: NextRequest) {
   }
 
   try {
-    const { idToken } = await exchangeCode(config, code, stored.verifier);
-    const verified = await verifyIdToken(config, idToken, stored.nonce);
+    const { idToken, accessToken } = await exchangeCode(config, code, stored.verifier);
+    const verified = await verifyIdToken(config, idToken, stored.nonce, accessToken);
     const session = await signSession({
       sub: verified.sub,
       tenantId: verified.tenantId,

lib/oidc.ts

@@ -128,6 +128,7 @@ export async function verifyIdToken(
   config: OidcConfig,
   idToken: string,
   expectedNonce: string,
+  accessToken?: string,
 ): Promise<VerifiedIdToken> {
   const { payload } = await jwtVerify(idToken, keySet(config.issuer), {
     issuer: config.issuer,