[rd-code-23]

Summary

• document Google OIDC with PostgreSQL-backed server-side sessions
• specify an opaque session ID in an HttpOnly cookie and no application JWT for the MVP
• define server-side authentication, authorization, logout, cookie, and CSRF requirements
• add ADR 0001 selecting the maintained authentication libraries
• record alternatives, consequences, and deployment-dependent follow-up decisions

Authentication library decision

• openid-client for Google OIDC
• express-session for session lifecycle and cookie handling
• connect-pg-simple for PostgreSQL session persistence
• csrf-sync for synchronizer-token CSRF protection
• reuse the existing pg pool
• do not add Passport or retain Google provider tokens for the MVP

Why

GoForLift has one browser client, one Express API, and PostgreSQL. This stack keeps protocol handling and session behavior in maintained libraries while preserving straightforward logout and revocation without adding Redis, Passport, or application JWT complexity.

Validation

• pnpm prettier --check docs/architecture.md docs/decisions/0001-authentication-libraries.md — passed
• git diff --check — passed
• pnpm format:check — currently reports a pre-existing formatting issue in .github/workflows/ci.yml, which this PR does not modify

Closes #3