Complete OIDC Auth Implementation

Hello, I've been working on a Supabase project to provide federated signin via my Keycloak server via OIDC/OAuth2.0, which Supabase ostensibly supports. After starting the project and getting into the weeds however, it seems that the Supabase implementation is at best incomplete, which has been rather frustrating. For example • Supabase Auth returns provider_token and provider_refresh_token which are stored in session cookies, but these are mysteriously overwritten and never refreshed when setSession is called, or seemingly at random? The docs seem contradictory as to whether this hasn't been implemented 'yet' or never will be. • Documentation is severely lacking on how to actually handle third party integration in practice. All github issues so far seem to just say its "your responsibility" with no guidance on how to take said responsibility • Supabase logout doesn't log out of the federated provider - why not? It seems…