Summary
Turning off an OAuth provider in instance settings hides its login button but does not actually block sign-in. Hitting the provider's route directly still completes a full login.
Where
internal/handler/oauth.go (Initiate/Callback/resolveProvider) and oauth_config.go. resolveProvider builds a provider purely on credential presence (client id + secret non-empty). Neither Initiate nor Callback ever checks the auth settings section's per-provider booleans (auth.google / auth.github / auth.gitlab), even though InstanceAuthConfig computes is_<provider>_enabled = <provider>Allowed && credentialsReady, so that toggle is the documented on/off switch.
Repro
As an instance admin, disable GitHub SSO (auth.github = false) but leave the client credentials in place (the normal way to turn a provider off). The login page hides the GitHub button, but navigating directly to GET /auth/github/ then the callback completes a full sign-in, and if public signup is on, provisions an account. allow_public_signup is re-checked in the callback, but the provider-enabled flag is not.
Suggested fix
In resolveProvider/Callback, reject the provider unless its auth.<provider> boolean is true.
Summary
Turning off an OAuth provider in instance settings hides its login button but does not actually block sign-in. Hitting the provider's route directly still completes a full login.
Where
internal/handler/oauth.go(Initiate/Callback/resolveProvider) andoauth_config.go.resolveProviderbuilds a provider purely on credential presence (client id + secret non-empty). NeitherInitiatenorCallbackever checks theauthsettings section's per-provider booleans (auth.google/auth.github/auth.gitlab), even thoughInstanceAuthConfigcomputesis_<provider>_enabled = <provider>Allowed && credentialsReady, so that toggle is the documented on/off switch.Repro
As an instance admin, disable GitHub SSO (
auth.github = false) but leave the client credentials in place (the normal way to turn a provider off). The login page hides the GitHub button, but navigating directly toGET /auth/github/then the callback completes a full sign-in, and if public signup is on, provisions an account.allow_public_signupis re-checked in the callback, but the provider-enabled flag is not.Suggested fix
In
resolveProvider/Callback, reject the provider unless itsauth.<provider>boolean is true.