Andras Bacsai
f9e5a00312
fix(oauth): let pre-existing users link first identity without verification
...
Before OAuth identities existed, OAuth sign-in matched users by email
only. Add a created_before_oauth_identities flag, set for every user at
upgrade time, so their first OAuth identity links without a provider
email verification claim. The flag is cleared once an identity links.
Also trust Microsoft Entra ID user principal names and GitLab confirmed
primary emails as verified, and pass the email to hasVerifiedEmail.
Add tests using real provider payloads.
2026-09-29 22:11:06 +02:00
Andras Bacsai
df692e6278
fix(auth): honor instance registration for non-OIDC OAuth providers
2026-09-25 09:11:55 +02:00
Andras Bacsai
c8dea4badc
chore: align account lifecycle
2026-09-24 16:56:38 +02:00
Andras Bacsai
87685d1e09
chore: align control-plane behavior
2026-09-24 15:46:04 +02:00
Andras Bacsai
865ebe0bdd
fix(auth): improve OAuth sign-in handling
2026-09-21 14:00:14 +02:00
Andras Bacsai
ca5fcce39b
Reapply "Merge branch 'next' into main"
...
This reverts commit 7bbd91175f
2026-08-21 12:15:46 +02:00
Andras Bacsai
7bbd91175f
Revert "Merge branch 'next' into main"
...
This reverts commit 2598f3e4c883f1a2e503
2026-08-21 12:12:56 +02:00
Andras Bacsai
81227670e6
Reapply "Merge origin/next into main"
...
This reverts commit 15359833d3
2026-08-19 12:39:55 +02:00
Andras Bacsai
15359833d3
Revert "Merge origin/next into main"
...
This reverts commit 541d743907bb1d3f13f2
2026-08-19 12:33:16 +02:00
Andras Bacsai
3b08be1429
fix(auth): handle concurrent OAuth identity creation safely
...
Recover existing OAuth and OIDC identities after unique constraint races and reject boolean or floating-point provider IDs.
2026-08-18 15:43:46 +02:00
Andras Bacsai
d29139f4a3
fix(auth): reject OAuth logins without valid provider IDs
...
Add validation for missing, blank, and non-scalar provider user IDs and cover the rejection cases with feature tests.
2026-08-18 15:34:37 +02:00
Andras Bacsai
f9f26c547c
fix(auth): preserve OAuth identity across email changes
...
Link OAuth logins by provider user ID before matching email, refresh identity
claims on login, and skip password confirmation for SSO-linked users.
2026-08-18 15:27:27 +02:00
Andras Bacsai
21333f02f9
fix(settings): harden OIDC, email, and log drain flows
2026-06-15 12:35:05 +02:00
Andras Bacsai
e354840e5a
feat(auth): add OIDC SSO and registration controls
...
Add OIDC discovery, JWKS validation, Socialite integration, OAuth identity linking, and configurable registration policy for password and SSO signups. Update related settings/profile UI and tests.
2026-06-04 13:59:08 +02:00
Andras Bacsai
07f381b88c
Merge remote-tracking branch 'origin/next' into jean/port-exposes-improvement
2026-06-03 10:32:57 +02:00
Tristan Rhodes
519a186e84
fix: normalize oauth emails before matching users
2026-04-09 09:38:56 -06:00
Andras Bacsai
Tristan Rhodes