[WIP] Fix 404 error for attachments with OIDC local login disabled

[Copilot]

Fix OIDC Attachment Access Issue

Problem

When OIDC is used with HBOX_OPTIONS_ALLOW_LOCAL_LOGIN=false, attachments/images fail to load with broken image icons.

Root Cause Analysis

• Understand OIDC login flow
• Trace attachment token creation in backend
• Trace attachment token usage in frontend
• Identify cookie accessibility issue

Planned Solution

• Verify attachment token is created for OIDC users
• Ensure attachment token cookie is properly set with correct attributes
• Test with OIDC enabled and local login disabled
• Verify images load correctly after fix

Implementation Plan

The issue appears to be that the attachment token cookie may not be properly accessible to the frontend JavaScript after OIDC login redirect. Need to investigate cookie SameSite settings and ensure proper token delivery.

Original prompt

When OIDC is used, and "HBOX_OPTIONS_ALLOW_LOCAL_LOGIN" is set to false attachments will error out on the front-end and will have a 404 error message.

This needs to be fixed.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}