Page History

...

Browser                            GitHub
  │                                   │
  │   GET /login/oauth/authorize      │
  │   ?client_id=Ov23liDRnt6bVJ       │
  │   &scope=user:email               │
  │──────────────────────────────────→│
  │                                   │
  │            User logs in, clicks "Allow"	  |
  │                                   │
  │   302 Redirect to:                │
  │   verifyOauth?code=AUTH_CODE      │
  │←──────────────────────────────────│
  ▼
VerifyOauth.vue catches ?code=AUTH_CODE

...

OauthLoginAPIAuthenticatorCmd.authenticate()
  → _apiServer.loginUser()                    [ApiServer.java:1243]
    → accountMgr.authenticateUser()           [AccountManagerImpl.java:2850]
      → for (authenticator : _userAuthenticators) [line 2939]
        → OAuth2UserAuthenticator.authenticate()  [OAuth2UserAuthenticator.java:48]
          → GithubOAuth2Provider.verifyUser()     [GithubOAuth2Provider.java:70]

Step 5: Login Page (External Tab) Behavior

• On page load, the UI calls listOauthProvider without a domain parameter
• External tab is enabled if response.listoauthproviderresponse.count > 0
• Global provider buttons (Google/GitHub) are rendered from the returned list
• If no global providers exist but domain providers do, the tab is enabled with the message: "Enter your domain to see available providers"
• When the user enters a domain path in the domain field, the UI calls listOauthProvider with domain=<path>
• Domain-specific provider buttons are rendered, or "No OAuth providers configured for this domain" is shown
  
  

Other Changes

Admin commands — how providers get registered/updated/deleted

...

• domain_id = NULL indicates a global provider
• Unique constraint on (provider, domain_id) prevents duplicate registrations

Strict Scope for oauth2.enabled

The oauth2.enabled config key uses a new strictScope mode in ConfigKey.valueInScope() to prevent automatic inheritance from global to domain scope. Each domain must explicitly set oauth2.enabled=true to enable OAuth login.

Key difference from standard ConfigKey behavior: without strict scope, an unconfigured domain inherits the global value. With strict scope, unconfigured domains return null which is treated as disabled. This ensures domains must explicitly opt in to OAuth.

Implementation Details

• New overload: ConfigKey.valueInScope(Scope scope, Long id, boolean strictScope)
• Existing valueInScope(Scope, Long) delegates to new overload with strictScope=false for backward compatibility
• When strictScope=true and no scope-specific value exists, returns null instead of walking up the parent scope hierarchy
• All OAuth oauth2.enabled checks use: Boolean.TRUE.equals(OAuth2IsPluginEnabled.valueInScope(ConfigKey.Scope.Domain, domainId, true))