feat: add support for OAuth-only login mode and update configuration handling

app/[locale]/login/page.tsx

@@ -29,7 +29,7 @@ export default function LoginPage() {
   const params = useParams();
   const { login, isLoading, error, clearError, isAuthenticated } = useAuthStore();
   const { theme, setTheme, initializeTheme } = useThemeStore();
-  const { appName, jmapServerUrl: serverUrl, oauthEnabled, oauthClientId, oauthIssuerUrl, rememberMeEnabled, devMode, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, isLoading: configLoading, error: configError } = useConfig();
+  const { appName, jmapServerUrl: serverUrl, oauthEnabled, oauthOnly, oauthClientId, oauthIssuerUrl, rememberMeEnabled, devMode, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, isLoading: configLoading, error: configError } = useConfig();
 
   const [formData, setFormData] = useState({
     username: "",
@@ -491,6 +491,41 @@ export default function LoginPage() {
                   Dev mode — logging in as dev@localhost
                 </p>
               </div>
+            ) : oauthOnly ? (
+              /* OAuth-only mode: show SSO button only */
+              <div className="space-y-4">
+                {oauthMetadata ? (
+                  <Button
+                    type="button"
+                    className="w-full h-11 font-medium text-[15px] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
+                    onClick={handleOAuthLogin}
+                    disabled={oauthLoading}
+                  >
+                    {oauthLoading ? (
+                      <div className="flex items-center gap-2">
+                        <Loader2 className="w-4 h-4 animate-spin" />
+                        {t("signing_in")}
+                      </div>
+                    ) : (
+                      <div className="flex items-center gap-2">
+                        <LogIn className="w-4 h-4" />
+                        {t("sign_in_sso")}
+                      </div>
+                    )}
+                  </Button>
+                ) : oauthDiscoveryDone ? (
+                  <div className="p-3.5 bg-amber-500/10 border border-amber-500/20 rounded-xl flex items-start gap-2">
+                    <AlertCircle className="w-4 h-4 text-amber-700 dark:text-amber-400 flex-shrink-0 mt-0.5" />
+                    <p className="text-sm text-amber-700 dark:text-amber-400">
+                      {t("error.oauth_discovery_failed")}
+                    </p>
+                  </div>
+                ) : (
+                  <div className="flex justify-center py-4">
+                    <Loader2 className="w-6 h-6 animate-spin text-primary" />
+                  </div>
+                )}
+              </div>
             ) : (
               /* Login Form */
               <form onSubmit={handleSubmit} className="space-y-5">

app/api/auth/session/route.ts

@@ -14,6 +14,10 @@ const COOKIE_OPTIONS = {
 
 export async function POST(request: NextRequest) {
   try {
+    if (process.env.OAUTH_ENABLED === 'true' && process.env.OAUTH_ONLY === 'true') {
+      return NextResponse.json({ error: 'Basic authentication is disabled' }, { status: 403 });
+    }
+
     const { serverUrl, username, password } = await request.json();
     if (!serverUrl || !username || !password) {
       return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });

app/api/config/route.ts

@@ -19,6 +19,7 @@ export async function GET() {
     appName: process.env.APP_NAME || process.env.NEXT_PUBLIC_APP_NAME || 'Webmail',
     jmapServerUrl: process.env.JMAP_SERVER_URL || process.env.NEXT_PUBLIC_JMAP_SERVER_URL || '',
     oauthEnabled: process.env.OAUTH_ENABLED === 'true',
+    oauthOnly: process.env.OAUTH_ENABLED === 'true' && process.env.OAUTH_ONLY === 'true',
     oauthClientId: process.env.OAUTH_CLIENT_ID || '',
     oauthIssuerUrl: process.env.OAUTH_ISSUER_URL || '',
     rememberMeEnabled: !!process.env.SESSION_SECRET,