From b090bf6d52694b61c9ab52927557ed598c0e3d3f Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Thu, 12 Mar 2026 22:05:29 +0100
Subject: [PATCH] feat: add support for OAuth-only login mode and update
 configuration handling

---
 .env.example                  |  4 ++++
 app/[locale]/login/page.tsx   | 37 ++++++++++++++++++++++++++++++++++-
 app/api/auth/session/route.ts |  4 ++++
 app/api/config/route.ts       |  1 +
 hooks/use-config.ts           |  4 ++++
 5 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 34e78622..668a2442 100644
--- a/.env.example
+++ b/.env.example
@@ -27,6 +27,10 @@ JMAP_SERVER_URL=https://your-jmap-server.com
 # Set to "true" to use OAuth instead of basic JMAP authentication
 # OAUTH_ENABLED=true
 
+# Set to "true" to only allow OAuth login (hides username/password form)
+# Requires OAUTH_ENABLED=true
+# OAUTH_ONLY=true
+
 # OAuth client ID registered with your identity provider
 # OAUTH_CLIENT_ID=your-client-id
 
diff --git a/app/[locale]/login/page.tsx b/app/[locale]/login/page.tsx
index 7ffe5cf6..bd770b9e 100644
--- a/app/[locale]/login/page.tsx
+++ b/app/[locale]/login/page.tsx
@@ -29,7 +29,7 @@ export default function LoginPage() {
   const params = useParams();
   const { login, isLoading, error, clearError, isAuthenticated } = useAuthStore();
   const { theme, setTheme, initializeTheme } = useThemeStore();
-  const { appName, jmapServerUrl: serverUrl, oauthEnabled, oauthClientId, oauthIssuerUrl, rememberMeEnabled, devMode, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, isLoading: configLoading, error: configError } = useConfig();
+  const { appName, jmapServerUrl: serverUrl, oauthEnabled, oauthOnly, oauthClientId, oauthIssuerUrl, rememberMeEnabled, devMode, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, isLoading: configLoading, error: configError } = useConfig();
 
   const [formData, setFormData] = useState({
     username: "",
@@ -491,6 +491,41 @@ export default function LoginPage() {
                   Dev mode — logging in as dev@localhost
                 </p>
               </div>
+            ) : oauthOnly ? (
+              /* OAuth-only mode: show SSO button only */
+              <div className="space-y-4">
+                {oauthMetadata ? (
+                  <Button
+                    type="button"
+                    className="w-full h-11 font-medium text-[15px] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
+                    onClick={handleOAuthLogin}
+                    disabled={oauthLoading}
+                  >
+                    {oauthLoading ? (
+                      <div className="flex items-center gap-2">
+                        <Loader2 className="w-4 h-4 animate-spin" />
+                        {t("signing_in")}
+                      </div>
+                    ) : (
+                      <div className="flex items-center gap-2">
+                        <LogIn className="w-4 h-4" />
+                        {t("sign_in_sso")}
+                      </div>
+                    )}
+                  </Button>
+                ) : oauthDiscoveryDone ? (
+                  <div className="p-3.5 bg-amber-500/10 border border-amber-500/20 rounded-xl flex items-start gap-2">
+                    <AlertCircle className="w-4 h-4 text-amber-700 dark:text-amber-400 flex-shrink-0 mt-0.5" />
+                    <p className="text-sm text-amber-700 dark:text-amber-400">
+                      {t("error.oauth_discovery_failed")}
+                    </p>
+                  </div>
+                ) : (
+                  <div className="flex justify-center py-4">
+                    <Loader2 className="w-6 h-6 animate-spin text-primary" />
+                  </div>
+                )}
+              </div>
             ) : (
               /* Login Form */
               <form onSubmit={handleSubmit} className="space-y-5">
diff --git a/app/api/auth/session/route.ts b/app/api/auth/session/route.ts
index cf33808f..92af2d3d 100644
--- a/app/api/auth/session/route.ts
+++ b/app/api/auth/session/route.ts
@@ -14,6 +14,10 @@ const COOKIE_OPTIONS = {
 
 export async function POST(request: NextRequest) {
   try {
+    if (process.env.OAUTH_ENABLED === 'true' && process.env.OAUTH_ONLY === 'true') {
+      return NextResponse.json({ error: 'Basic authentication is disabled' }, { status: 403 });
+    }
+
     const { serverUrl, username, password } = await request.json();
     if (!serverUrl || !username || !password) {
       return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
diff --git a/app/api/config/route.ts b/app/api/config/route.ts
index 239c4f2e..c5bde963 100644
--- a/app/api/config/route.ts
+++ b/app/api/config/route.ts
@@ -19,6 +19,7 @@ export async function GET() {
     appName: process.env.APP_NAME || process.env.NEXT_PUBLIC_APP_NAME || 'Webmail',
     jmapServerUrl: process.env.JMAP_SERVER_URL || process.env.NEXT_PUBLIC_JMAP_SERVER_URL || '',
     oauthEnabled: process.env.OAUTH_ENABLED === 'true',
+    oauthOnly: process.env.OAUTH_ENABLED === 'true' && process.env.OAUTH_ONLY === 'true',
     oauthClientId: process.env.OAUTH_CLIENT_ID || '',
     oauthIssuerUrl: process.env.OAUTH_ISSUER_URL || '',
     rememberMeEnabled: !!process.env.SESSION_SECRET,
diff --git a/hooks/use-config.ts b/hooks/use-config.ts
index bddb7935..31fc5394 100644
--- a/hooks/use-config.ts
+++ b/hooks/use-config.ts
@@ -6,6 +6,7 @@ interface ConfigData {
   appName: string;
   jmapServerUrl: string;
   oauthEnabled: boolean;
+  oauthOnly: boolean;
   oauthClientId: string;
   oauthIssuerUrl: string;
   rememberMeEnabled: boolean;
@@ -69,6 +70,7 @@ export function useConfig(): AppConfig {
     appName: configCache?.appName || 'Webmail',
     jmapServerUrl: configCache?.jmapServerUrl || '',
     oauthEnabled: configCache?.oauthEnabled || false,
+    oauthOnly: configCache?.oauthOnly || false,
     oauthClientId: configCache?.oauthClientId || '',
     oauthIssuerUrl: configCache?.oauthIssuerUrl || '',
     rememberMeEnabled: configCache?.rememberMeEnabled || false,
@@ -90,6 +92,7 @@ export function useConfig(): AppConfig {
         appName: configCache.appName,
         jmapServerUrl: configCache.jmapServerUrl,
         oauthEnabled: configCache.oauthEnabled,
+        oauthOnly: configCache.oauthOnly,
         oauthClientId: configCache.oauthClientId,
         oauthIssuerUrl: configCache.oauthIssuerUrl,
         rememberMeEnabled: configCache.rememberMeEnabled,
@@ -112,6 +115,7 @@ export function useConfig(): AppConfig {
           appName: data.appName,
           jmapServerUrl: data.jmapServerUrl,
           oauthEnabled: data.oauthEnabled,
+          oauthOnly: data.oauthOnly,
           oauthClientId: data.oauthClientId,
           oauthIssuerUrl: data.oauthIssuerUrl,
           rememberMeEnabled: data.rememberMeEnabled,