starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-26 01:10:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): honor instance registration for non-OIDC OAuth providers

Browse Source
This commit is contained in:
Andras Bacsai
2026-09-25 09:11:55 +02:00
parent 0f41b8e6d9
commit df692e6278
2 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Services/Auth/OauthLoginService.php
+9 -1
View File
@@ -229,9 +229,17 @@ class OauthLoginService
}
}
/**
* Only OIDC exposes a provider-level user creation setting. Other providers
* follow the instance registration setting, as before OIDC support.
*/
private function canCreateUser(OauthSetting $oauthSetting): bool
{
return instanceSettings()->is_registration_enabled || $oauthSetting->allow_registration;
if (instanceSettings()->is_registration_enabled) {
return true;
}
return $oauthSetting->provider === 'oidc' && $oauthSetting->allow_registration;
}
private function createUser(string $name, string $email, OauthSetting $oauthSetting): User
tests/Feature/OauthControllerTest.php
+45
View File
@@ -225,6 +225,51 @@ it('registers a new user from a verified provider identity', function () {
]);
});
it('does not register a new user through a non-OIDC provider when registration is disabled', function (string $provider, array $rawClaims) {
// Upgraded installs have allow_registration = true on every provider row (column default).
OauthSetting::updateOrCreate(['provider' => $provider], [
'client_id' => 'client-id',
'client_secret' => 'client-secret',
'enabled' => true,
'allow_registration' => true,
]);
expect(fn () => app(OauthLoginService::class)->login($provider, (object) [
'email' => 'stranger@example.com',
'name' => 'Stranger',
'id' => 'stranger-id',
'user' => $rawClaims,
], OauthSetting::where('provider', $provider)->firstOrFail()))->toThrow(HttpException::class, 'Registration is disabled');
$this->assertGuest();
expect(User::count())->toBe(0)
->and(OauthIdentity::count())->toBe(0);
})->with([
'github' => ['github', []],
'google' => ['google', ['verified_email' => true, 'hd' => 'example.com']],
]);
it('registers a new user through a non-OIDC provider when registration is enabled', function () {
InstanceSettings::findOrFail(0)->update(['is_registration_enabled' => true]);
OauthSetting::create([
'provider' => 'github',
'client_id' => 'client-id',
'client_secret' => 'client-secret',
'enabled' => true,
'allow_registration' => false,
]);
$user = app(OauthLoginService::class)->login('github', (object) [
'email' => 'new-user@example.com',
'name' => 'New User',
'id' => 'github-new-user-id',
'user' => [],
], OauthSetting::where('provider', 'github')->firstOrFail());
expect($user->email)->toBe('new-user@example.com');
$this->assertAuthenticatedAs($user);
});
it('does not link another provider identity to an account by shared email', function () {
$user = User::factory()->create(['email' => 'shared@example.com']);
OauthIdentity::create([