ARUNAVO RAY 66e3284898 fix(sso): repair SSO login bounce + migrate to @better-auth/oauth-provider (#307) ...

Resolves #306. SSO sign-in via OIDC (Authentik / Keycloak / etc.) now links the
SSO identity to an existing email/password admin instead of bouncing to /login
with `?error=UNKNOWN`. Account-linking is gated on the operator-supplied
**Domain** field — cross-domain claims from a compromised IdP are refused.

Also bundles the deprecated `oidcProvider` → `@better-auth/oauth-provider`
migration. **Operators using the OAuth-provider feature must rotate registered
client secrets after upgrade** (legacy plaintext → hashed storage; see the
0012 migration notes).

Verified end-to-end on the pr-307 image against a real Authentik instance:
SSO login lands on the dashboard, `accounts` table gets both `credential` and
`authentik` rows for the same user. See PR description for full details.

2026-06-02 11:40:54 +05:30

..

assets

Updated screenshots

2025-10-22 19:55:56 +05:30

ci

refactor: rename skipStarredIssues to starredCodeOnly

2025-10-03 09:22:18 +05:30

screenshots

feat: smart force-push protection with backup strategies (#206)

2026-03-02 15:48:59 +05:30

workflows

fix(sso): repair SSO login bounce + migrate to @better-auth/oauth-provider (#307)

2026-06-02 11:40:54 +05:30

FUNDING.yml

Create FUNDING.yml

2025-07-17 11:18:04 +05:30