sync: update from private repo (6be06e0)

src/bridge/auth.test.ts

@@ -220,4 +220,15 @@ describe('isProviderActive (primaryProvider restriction)', () => {
     expect(isProviderActive(c, 'gitea')).toBe(true); // gitea still usable
     expect(isProviderActive(c, 'google')).toBe(false); // google not configured
   });
+  it('does not throw when providers is entirely absent (local-only config)', () => {
+    // Saving "local only" from the Settings UI can persist an auth block with
+    // no providers key at all. The OAuth helpers + strategy registration must
+    // treat that as "no OAuth provider configured", not crash.
+    const c = {
+      sessionSecret: 's', sessionMaxAge: 1, secureCookie: false, adminEmails: [],
+    } as AuthConfig;
+    expect(() => isProviderActive(c, 'google')).not.toThrow();
+    expect(isProviderActive(c, 'google')).toBe(false);
+    expect(isProviderActive(c, 'gitea')).toBe(false);
+  });
 });

src/bridge/auth.ts

@@ -67,10 +67,10 @@ export function isProviderConfigured(
  * An invalid primary (pointing at an unconfigured provider) is ignored.
  */
 export function isProviderActive(authConfig: AuthConfig, kind: 'google' | 'gitea'): boolean {
-  if (!isProviderConfigured(authConfig.providers[kind], kind)) return false;
+  if (!isProviderConfigured(authConfig.providers?.[kind], kind)) return false;
   const primary = authConfig.primaryProvider;
-  if (primary === 'google' && isProviderConfigured(authConfig.providers.google, 'google')) return kind === 'google';
-  if (primary === 'gitea' && isProviderConfigured(authConfig.providers.gitea, 'gitea')) return kind === 'gitea';
+  if (primary === 'google' && isProviderConfigured(authConfig.providers?.google, 'google')) return kind === 'google';
+  if (primary === 'gitea' && isProviderConfigured(authConfig.providers?.gitea, 'gitea')) return kind === 'gitea';
   // primary=local restricts login to local accounts → OAuth providers off.
   if (primary === 'local' && isLocalEnabled(authConfig)) return false;
   return true;
@@ -132,8 +132,8 @@ export function buildChangePasswordHandler(repo: Repository): RequestHandler {
  */
 function renderLoginPage(authConfig: AuthConfig, branding: LoginBranding = DEFAULT_LOGIN_BRANDING): string {
   const raw = readFileSync(path.join(__authDirname, 'auth-login.html'), 'utf-8');
-  const googleConfigured = isProviderConfigured(authConfig.providers.google, 'google');
-  const giteaConfigured = isProviderConfigured(authConfig.providers.gitea, 'gitea');
+  const googleConfigured = isProviderConfigured(authConfig.providers?.google, 'google');
+  const giteaConfigured = isProviderConfigured(authConfig.providers?.gitea, 'gitea');
   const localEnabled = isLocalEnabled(authConfig);
   const allowSignup = authConfig.local?.allowSignup === true;
   // Ignore a primaryProvider that points to an unconfigured/disabled provider —
@@ -413,7 +413,7 @@ export async function fetchGiteaOrgsForUser(
 // ── Strategy Registration ─────────────────────────────────────────────────────
 
 function registerGoogleStrategy(repo: Repository, authConfig: AuthConfig): void {
-  const googleConfig = authConfig.providers.google;
+  const googleConfig = authConfig.providers?.google;
   if (!isProviderConfigured(googleConfig, 'google')) return;
   if (!isProviderActive(authConfig, 'google')) return;
 
@@ -445,7 +445,7 @@ function registerGoogleStrategy(repo: Repository, authConfig: AuthConfig): void
 }
 
 function registerGiteaStrategy(repo: Repository, authConfig: AuthConfig): void {
-  const giteaConfig = authConfig.providers.gitea;
+  const giteaConfig = authConfig.providers?.gitea;
   if (!isProviderConfigured(giteaConfig, 'gitea')) return;
   if (!isProviderActive(authConfig, 'gitea')) return;