From 7cbb226e6207b7af12592ef1c4bedfa9123b53f9 Mon Sep 17 00:00:00 2001
From: bruno <bruno.charest@gmail.com>
Date: Mon, 13 Jul 2026 15:23:10 -0400
Subject: [PATCH] =?UTF-8?q?fix:=20Register/Link=20with=20Gitea=20ne=20cr?=
 =?UTF-8?q?=C3=A9e=20plus=20de=20session=20admin=20fant=C3=B4me?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avant: get_provider('gitea') → None (pas de client OAuth configuré)
       → fallback créait automatiquement une session admin
       → le bouton 'Register with Gitea' connectait l'utilisateur en admin !

Après: affiche une page d'erreur propre:
       '⚠ Gitea OAuth not configured — The Gitea integration has not
        been set up by the server administrator. ↩ Use local login'
---
 app/routers/auth.py | 33 +++++++++++++++------------------
 1 file changed, 15 insertions(+), 18 deletions(-)

diff --git a/app/routers/auth.py b/app/routers/auth.py
index 8983141..2ca238a 100644
--- a/app/routers/auth.py
+++ b/app/routers/auth.py
@@ -89,31 +89,28 @@ async function handleLogin(e){e.preventDefault();const email=document.getElement
 async def login(request: Request, provider: str = Query("gitea")):
     """Redirect to OAuth2 authorize page or show local login page."""
     # Local login page (POST handled by /auth/local-login)
+    from fastapi.responses import HTMLResponse
     if provider == "local":
-        from fastapi.responses import HTMLResponse
         return HTMLResponse(LOCAL_LOGIN_HTML, status_code=200)
 
     # OAuth flow — check if provider is configured
     from app.auth.providers import get_provider
     oauth_provider = get_provider(provider)
     if not oauth_provider:
-        # Fallback: no OAuth configured, create admin session
-        from app.db import get_conn
-        with get_conn() as conn:
-            user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
-            if not user:
-                conn.execute(
-                    "INSERT INTO users (login, full_name, email, avatar_url, is_active) "
-                    "VALUES ('admin', 'Admin', 'admin@localhost', '', 1)"
-                )
-                conn.commit()
-                user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
-        user_data = dict(user)
-        session = SessionManager.create_session(user_data)
-        _log_login(user_data["id"], request)
-        response = RedirectResponse(url="/workspaces", status_code=302)
-        response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
-        return response
+        # OAuth provider not configured — show error instead of auto-creating admin
+        return HTMLResponse(
+            f"""<!DOCTYPE html><html><head><title>FlowDeck</title><style>
+            body{{background:#191919;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;}}
+            .box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:420px;}}
+            h1{{font-size:20px;margin-bottom:12px;}}p{{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:16px;}}
+            a{{color:#2383E2;}}
+            </style></head><body><div class="box">
+            <h1>⚠️ {provider.title()} OAuth not configured</h1>
+            <p>The {provider} integration has not been set up by the server administrator.</p>
+            <p><a href="/auth/login?provider=local">↩ Use local login</a></p>
+            </div></body></html>""",
+            status_code=200,
+        )
 
     state = secrets.token_hex(32)
     request.session["oauth_state"] = state