Fixes#306 and migrates the deprecated oidc-provider plugin to @better-auth/oauth-provider (the deprecation warning seen in the issue logs).
Warning
This bundles a low-risk bug fix with a breaking, IdP-side schema migration that could not be end-to-end tested locally. See "Verification status" below. Review the two halves independently.
The reporter clicks SSO (Authentik), is bounced back to /login. Root cause: after the OAuth round-trip the browser lands on / with no session, so MainLayout redirects to /login. The 401 /api/sso/applications in the report is unrelated noise (it backs the OAuth provider consent UI).
Fixes:
Account linking (src/lib/auth.ts): added account.accountLinking with trustedProviders: ["email-password"]. Better Auth enables linking by default, but auto-linking an SSO sign-in to a pre-existing email/password account only happens for trusted providers or verified emails — otherwise the sign-in fails and bounces. This is the most likely cause of #306.
Working debug logs: Better Auth does not read DEBUG (it's not the debug npm package), so the docs' DEBUG=better-auth:* was a no-op and the reporter saw nothing. Added a logger block driven by BETTER_AUTH_LOG_LEVEL (debug|info|warn|error, default warn). Updated docs/SSO_TESTING.md, docs/ENVIRONMENT_VARIABLES.md, .env.example.
This half is config/docs only and directly addresses #306.
Part 2 — oidcProvider → oauthProvider migration (breaking, provider/IdP side)
Rewrote /api/sso/applications and /api/auth/oauth2/register against the new plugin API (createOAuthClient / registerOAuthClient / *OAuthClient).
Added a 0012 upgrade fixture to scripts/validate-migrations.ts.
Verification status
✅Verified locally
Migration 0012 applies cleanly on a fresh DB; old tables dropped, new tables present; redirect_urls → JSON transform correct (asserted in the migration-validation fixture).
auth.ts constructs and exposes createOAuthClient / registerOAuthClient / oauth2Consent.
Full test suite: 289 pass / 0 fail.
⚠️NOT verifiable locally — needs manual testing before merge (no IdP runtime; project can't run astro check/build locally)
End-to-end OAuth-provider flow: authorize → consent page → code → token → userinfo against a real relying party.
Migrated client secrets won't validate: legacy secrets were stored in plaintext; the new provider stores them hashed. Affected apps must rotate their secret after upgrade (called out in the migration file).
OIDC discovery: startup logs a warning that /.well-known/oauth-authorization-server sits under /api/auth (due to basePath). RPs expecting it at root may need the exported oauthProviderAuthServerMetadata handler mounted at /. Follow-up.
Test plan
Authentik SSO login links to the existing admin account (no bounce)
Register an OAuth client and complete an authorize→consent→token flow
Existing registered clients survive the upgrade (rotate secret)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/307
**Author:** [@arunavo4](https://github.com/arunavo4)
**Created:** 5/29/2026
**Status:** ✅ Merged
**Merged:** 6/2/2026
**Merged by:** [@arunavo4](https://github.com/arunavo4)
**Base:** `main` ← **Head:** `fix/sso-login-and-oauth-provider-migration`
---
### 📝 Commits (6)
- [`06f9c13`](https://github.com/RayLabsHQ/gitea-mirror/commit/06f9c1334293686f980201de6348063b52da90fb) fix(sso): repair SSO login bounce + migrate to @better-auth/oauth-provider
- [`0e6df2e`](https://github.com/RayLabsHQ/gitea-mirror/commit/0e6df2e3ac3054f462c685f30c57042a4d25d17f) fix(sso): finish SSO bounce repair — verified end-to-end against Authentik
- [`df62e45`](https://github.com/RayLabsHQ/gitea-mirror/commit/df62e4593eb85a20dea4852045fa5239da8aea38) fix(sso): drop dynamic trustedProviders — rely on IdP's email_verified claim
- [`1e2ce9a`](https://github.com/RayLabsHQ/gitea-mirror/commit/1e2ce9a26b9254bdec978eb79598b2de755cbfc0) fix(sso): domain-scoped account linking + rebuild snapshot chain
- [`bc06f10`](https://github.com/RayLabsHQ/gitea-mirror/commit/bc06f10cc8d91add44ecc9cc8ecc691f91c2351f) fix(sso): enable domainVerification so the model surfaces domainVerified
- [`ceaf89b`](https://github.com/RayLabsHQ/gitea-mirror/commit/ceaf89bc2534c43ea36b067be3c314e4c1f0ada4) ci(e2e): retry docker compose pull on transient Docker Hub timeouts
### 📊 Changes
**22 files changed** (+5467 additions, -188 deletions)
<details>
<summary>View changed files</summary>
📝 `.env.example` (+3 -0)
📝 `.github/workflows/e2e-tests.yml` (+18 -0)
📝 `.gitignore` (+1 -0)
📝 `bun.lock` (+3 -0)
📝 `docs/ENVIRONMENT_VARIABLES.md` (+1 -0)
📝 `docs/SSO-OIDC-SETUP.md` (+20 -3)
📝 `docs/SSO_TESTING.md` (+50 -2)
➕ `drizzle/0012_oauth_provider_migration.sql` (+126 -0)
➕ `drizzle/0013_slim_galactus.sql` (+35 -0)
➕ `drizzle/meta/0012_snapshot.json` (+2358 -0)
➕ `drizzle/meta/0013_snapshot.json` (+2375 -0)
📝 `drizzle/meta/_journal.json` (+15 -1)
📝 `package.json` (+1 -0)
📝 `scripts/validate-migrations.ts` (+110 -0)
📝 `src/components/oauth/ConsentPage.tsx` (+15 -27)
📝 `src/lib/auth-client.ts` (+2 -2)
📝 `src/lib/auth.ts` (+97 -11)
📝 `src/lib/db/index.ts` (+4 -2)
📝 `src/lib/db/schema.ts` (+106 -45)
📝 `src/pages/api/auth/oauth2/register.ts` (+5 -5)
_...and 2 more files_
</details>
### 📄 Description
Fixes #306 and migrates the deprecated `oidc-provider` plugin to `@better-auth/oauth-provider` (the deprecation warning seen in the issue logs).
> [!WARNING]
> **This bundles a low-risk bug fix with a breaking, IdP-side schema migration that could not be end-to-end tested locally.** See "Verification status" below. Review the two halves independently.
---
## Part 1 — #306 SSO login bounce (the reported bug)
The reporter clicks SSO (Authentik), is bounced back to `/login`. Root cause: after the OAuth round-trip the browser lands on `/` with **no session**, so `MainLayout` redirects to `/login`. The `401 /api/sso/applications` in the report is unrelated noise (it backs the OAuth *provider* consent UI).
**Fixes:**
- **Account linking** (`src/lib/auth.ts`): added `account.accountLinking` with `trustedProviders: ["email-password"]`. Better Auth enables linking by default, but auto-linking an SSO sign-in to a *pre-existing email/password account* only happens for trusted providers or verified emails — otherwise the sign-in fails and bounces. This is the most likely cause of #306.
- **Working debug logs**: Better Auth does **not** read `DEBUG` (it's not the `debug` npm package), so the docs' `DEBUG=better-auth:*` was a no-op and the reporter saw nothing. Added a `logger` block driven by **`BETTER_AUTH_LOG_LEVEL`** (`debug|info|warn|error`, default `warn`). Updated `docs/SSO_TESTING.md`, `docs/ENVIRONMENT_VARIABLES.md`, `.env.example`.
This half is config/docs only and directly addresses #306.
## Part 2 — `oidcProvider` → `oauthProvider` migration (breaking, provider/IdP side)
- `auth.ts`: `oidcProvider` → `oauthProvider`; added required `jwt()` plugin (JWKS signing keys); ported `getAdditionalUserInfoClaim` → `customUserInfoClaims`/`customIdTokenClaims`.
- `auth-client.ts`: `oidcClient` → `oauthProviderClient`.
- `ConsentPage.tsx`: updated to the new `/oauth2/consent` flow (passes `oauth_query`, navigates to returned `redirect_uri`).
- **Schema** (`schema.ts`): `oauth_applications` → `oauth_clients`, reshaped `oauth_access_tokens`, new `oauth_refresh_tokens`, `oauth_consent` → `oauth_consents`, plus `jwks`.
- **Migration `0012`**: data-preserving — copies registered clients and converts comma-separated `redirect_urls` → JSON `string[]`. Access tokens/consents are dropped (ephemeral / cheaply re-granted).
- Rewrote `/api/sso/applications` and `/api/auth/oauth2/register` against the new plugin API (`createOAuthClient` / `registerOAuthClient` / `*OAuthClient`).
- Added a `0012` upgrade fixture to `scripts/validate-migrations.ts`.
## Verification status
✅ **Verified locally**
- Migration `0012` applies cleanly on a fresh DB; old tables dropped, new tables present; `redirect_urls` → JSON transform correct (asserted in the migration-validation fixture).
- `auth.ts` constructs and exposes `createOAuthClient` / `registerOAuthClient` / `oauth2Consent`.
- Full test suite: **289 pass / 0 fail**.
⚠️ **NOT verifiable locally — needs manual testing before merge** (no IdP runtime; project can't run `astro check`/build locally)
- End-to-end OAuth-provider flow: authorize → consent page → code → token → userinfo against a real relying party.
- **Migrated client secrets won't validate**: legacy secrets were stored in plaintext; the new provider stores them hashed. Affected apps must **rotate their secret** after upgrade (called out in the migration file).
- OIDC discovery: startup logs a warning that `/.well-known/oauth-authorization-server` sits under `/api/auth` (due to `basePath`). RPs expecting it at root may need the exported `oauthProviderAuthServerMetadata` handler mounted at `/`. **Follow-up.**
## Test plan
- [ ] Authentik SSO login links to the existing admin account (no bounce)
- [ ] `BETTER_AUTH_LOG_LEVEL=debug` surfaces `[Better Auth]` callback trace
- [ ] Register an OAuth client and complete an authorize→consent→token flow
- [ ] Existing registered clients survive the upgrade (rotate secret)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/307
Author: @arunavo4
Created: 5/29/2026
Status: ✅ Merged
Merged: 6/2/2026
Merged by: @arunavo4
Base:
main← Head:fix/sso-login-and-oauth-provider-migration📝 Commits (6)
06f9c13fix(sso): repair SSO login bounce + migrate to @better-auth/oauth-provider0e6df2efix(sso): finish SSO bounce repair — verified end-to-end against Authentikdf62e45fix(sso): drop dynamic trustedProviders — rely on IdP's email_verified claim1e2ce9afix(sso): domain-scoped account linking + rebuild snapshot chainbc06f10fix(sso): enable domainVerification so the model surfaces domainVerifiedceaf89bci(e2e): retry docker compose pull on transient Docker Hub timeouts📊 Changes
22 files changed (+5467 additions, -188 deletions)
View changed files
📝
.env.example(+3 -0)📝
.github/workflows/e2e-tests.yml(+18 -0)📝
.gitignore(+1 -0)📝
bun.lock(+3 -0)📝
docs/ENVIRONMENT_VARIABLES.md(+1 -0)📝
docs/SSO-OIDC-SETUP.md(+20 -3)📝
docs/SSO_TESTING.md(+50 -2)➕
drizzle/0012_oauth_provider_migration.sql(+126 -0)➕
drizzle/0013_slim_galactus.sql(+35 -0)➕
drizzle/meta/0012_snapshot.json(+2358 -0)➕
drizzle/meta/0013_snapshot.json(+2375 -0)📝
drizzle/meta/_journal.json(+15 -1)📝
package.json(+1 -0)📝
scripts/validate-migrations.ts(+110 -0)📝
src/components/oauth/ConsentPage.tsx(+15 -27)📝
src/lib/auth-client.ts(+2 -2)📝
src/lib/auth.ts(+97 -11)📝
src/lib/db/index.ts(+4 -2)📝
src/lib/db/schema.ts(+106 -45)📝
src/pages/api/auth/oauth2/register.ts(+5 -5)...and 2 more files
📄 Description
Fixes #306 and migrates the deprecated
oidc-providerplugin to@better-auth/oauth-provider(the deprecation warning seen in the issue logs).Part 1 — #306 SSO login bounce (the reported bug)
The reporter clicks SSO (Authentik), is bounced back to
/login. Root cause: after the OAuth round-trip the browser lands on/with no session, soMainLayoutredirects to/login. The401 /api/sso/applicationsin the report is unrelated noise (it backs the OAuth provider consent UI).Fixes:
src/lib/auth.ts): addedaccount.accountLinkingwithtrustedProviders: ["email-password"]. Better Auth enables linking by default, but auto-linking an SSO sign-in to a pre-existing email/password account only happens for trusted providers or verified emails — otherwise the sign-in fails and bounces. This is the most likely cause of #306.DEBUG(it's not thedebugnpm package), so the docs'DEBUG=better-auth:*was a no-op and the reporter saw nothing. Added aloggerblock driven byBETTER_AUTH_LOG_LEVEL(debug|info|warn|error, defaultwarn). Updateddocs/SSO_TESTING.md,docs/ENVIRONMENT_VARIABLES.md,.env.example.This half is config/docs only and directly addresses #306.
Part 2 —
oidcProvider→oauthProvidermigration (breaking, provider/IdP side)auth.ts:oidcProvider→oauthProvider; added requiredjwt()plugin (JWKS signing keys); portedgetAdditionalUserInfoClaim→customUserInfoClaims/customIdTokenClaims.auth-client.ts:oidcClient→oauthProviderClient.ConsentPage.tsx: updated to the new/oauth2/consentflow (passesoauth_query, navigates to returnedredirect_uri).schema.ts):oauth_applications→oauth_clients, reshapedoauth_access_tokens, newoauth_refresh_tokens,oauth_consent→oauth_consents, plusjwks.0012: data-preserving — copies registered clients and converts comma-separatedredirect_urls→ JSONstring[]. Access tokens/consents are dropped (ephemeral / cheaply re-granted)./api/sso/applicationsand/api/auth/oauth2/registeragainst the new plugin API (createOAuthClient/registerOAuthClient/*OAuthClient).0012upgrade fixture toscripts/validate-migrations.ts.Verification status
✅ Verified locally
0012applies cleanly on a fresh DB; old tables dropped, new tables present;redirect_urls→ JSON transform correct (asserted in the migration-validation fixture).auth.tsconstructs and exposescreateOAuthClient/registerOAuthClient/oauth2Consent.⚠️ NOT verifiable locally — needs manual testing before merge (no IdP runtime; project can't run
astro check/build locally)/.well-known/oauth-authorization-serversits under/api/auth(due tobasePath). RPs expecting it at root may need the exportedoauthProviderAuthServerMetadatahandler mounted at/. Follow-up.Test plan
BETTER_AUTH_LOG_LEVEL=debugsurfaces[Better Auth]callback trace🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.