The awaited call to ssoStore.getSSORedirectUrl() is executed before the try / catch block, so any rejection that occurs will bypass the error handler and result in an uncaught promise rejection.

OIDC users are not filtered out even though the PR introduces OIDC SSO; consequently action toggles will still be shown for OIDC accounts, likely violating the intended business rule (SSO accounts should be read-only).

Accessing settingsStore.settings.enterprise without optional chaining can throw if either settings or enterprise is undefined. Use optional chaining to avoid a runtime crash.

Any problem while importing or initializing the OIDC module will throw and crash the server because this block is not inside a try-catch, unlike the preceding SAML and subsequent Source Control initializations which handle errors gracefully.

resolveJwt does not use authIdentities, so loading this relation on every authenticated request performs an unnecessary join and increases DB query cost.

If authIdentities was not explicitly loaded when the entity was fetched, it will be undefined, so the condition !this.authIdentities?.[0] evaluates to true, incorrectly marking users with existing SSO identities as isPending. This can lead to false positives whenever the relation is not eager-loaded or joined in the query.

This exported function is the only one in the file without an explicit return-type annotation, so TypeScript infers Promise<any>. This weakens type-safety for callers and is inconsistent with the rest of the API helpers.