Move the user creation check from OauthLoginService into
OauthSetting::allowsUserCreation(), so the login view can use it.
The login view now gets a can_register_with_oauth flag. The flag is
true when an enabled OAuth provider allows creating new users. The
view uses it to show the new auth.register_with_oauth message.
Add translations for the message in all locales, plus test coverage.
Add OauthLoginException, which carries a translation key for the message
shown on the login page. The exception message only goes to the log.
OauthLoginService now throws it for an unverified email, an account that
is already linked to another identity, and disabled registration.
OauthController shows the matching message for each case. Other
HttpExceptions fall back to a generic OAuth failure message.
The email verification check now runs before the linked-identity check,
so an unverified email cannot reveal that an account is already linked.
Add translations for the new auth.failed.oauth* keys in all locales and
cover the new error messages with feature tests.
Add OIDC discovery, JWKS validation, Socialite integration, OAuth identity linking, and configurable registration policy for password and SSO signups. Update related settings/profile UI and tests.
Andras Bacsai
Timo
Sandro Sobczyński
Hauke Schnau
Yassir Elmarissi
Zao Soula
LeviandMarco