kolaente 783c0dd52a refactor(auth): make OIDC email-only fallback explicit instead of an empty-username sentinel ... The fallback block only runs when EmailFallback || UsernameFallback, so when UsernameFallback is off the else branch (previously an empty-username candidate) is the email-only lookup path: it must still run one GetUserWithEmail to link an existing local user by email. Removing it entirely would skip that lookup and create a duplicate user for the emailfallback-only config. Replace the empty-string sentinel with an explicit []*user.User candidate list built in a small helper, keeping the same behavior, and assert no duplicate is created in the email-only fallback test.		2026-06-19 19:38:10 +02:00
..
ldap	fix(auth): skip profile updates for disabled LDAP users	2026-03-23 16:37:26 +00:00
oauth2server	feat(audit): emit the login event for the OAuth code exchange	2026-06-12 08:56:08 +00:00
openid	refactor(auth): make OIDC email-only fallback explicit instead of an empty-username sentinel	2026-06-19 19:38:10 +02:00
auth.go	refactor(auth): extract transport-agnostic login, logout and OIDC cores	2026-06-17 19:43:41 +00:00
auth_test.go	feat(auth): add GetAuthFromContext for Huma handlers	2026-05-31 12:56:57 +00:00