feat: add OIDC auto-provision setting independent of registration toggle (#795)

Allows OIDC-authenticated users to be auto-provisioned even when
"Allow new account registration" is disabled. Adds an admin UI toggle
and corresponding API endpoints (GET/PATCH /users/oidc-auto-provision).
Falls back to OIDC_ALLOW_REGISTRATION env var if the setting is unset.

src/ui/sidebar/AdminSettingsPanel.tsx

@@ -31,6 +31,8 @@ import {
   getAdminOIDCConfig,
   updateOIDCConfig,
   disableOIDCConfig,
+  getOidcAutoProvision,
+  updateOidcAutoProvision,
   isElectron,
   getUserRoles,
   assignRoleToUser,
@@ -134,6 +136,7 @@ export function AdminSettingsPanel() {
   const [logLevel, setLogLevel] = useState("info");
 
   // OIDC state
+  const [oidcAutoProvision, setOidcAutoProvision] = useState(false);
   const [oidcClientId, setOidcClientId] = useState("");
   const [oidcClientSecret, setOidcClientSecret] = useState("");
   const [oidcAuthUrl, setOidcAuthUrl] = useState("");
@@ -238,7 +241,7 @@ export function AdminSettingsPanel() {
 
   async function loadGeneralSettings() {
     try {
-      const [reg, pwLogin, pwReset, timeout, monitoring, level, guac] =
+      const [reg, pwLogin, pwReset, timeout, monitoring, level, guac, oidcProv] =
         await Promise.allSettled([
           getRegistrationAllowed(),
           getPasswordLoginAllowed(),
@@ -247,11 +250,14 @@ export function AdminSettingsPanel() {
           getGlobalMonitoringSettings(),
           getLogLevel(),
           getGuacamoleSettings(),
+          getOidcAutoProvision(),
         ]);
 
       if (reg.status === "fulfilled") setAllowRegistration(reg.value.allowed);
       if (pwLogin.status === "fulfilled")
         setAllowPasswordLogin(pwLogin.value.allowed);
+      if (oidcProv.status === "fulfilled")
+        setOidcAutoProvision(oidcProv.value.enabled);
       if (pwReset.status === "fulfilled") setAllowPasswordReset(pwReset.value);
       if (timeout.status === "fulfilled")
         setSessionTimeout(String(timeout.value.timeoutHours));
@@ -321,6 +327,17 @@ export function AdminSettingsPanel() {
     }
   }
 
+  async function handleToggleOidcAutoProvision() {
+    const newVal = !oidcAutoProvision;
+    setOidcAutoProvision(newVal);
+    try {
+      await updateOidcAutoProvision(newVal);
+    } catch {
+      setOidcAutoProvision(!newVal);
+      toast.error("Failed to update OIDC auto-provision setting");
+    }
+  }
+
   async function handleTogglePasswordReset() {
     const newVal = !allowPasswordReset;
     setAllowPasswordReset(newVal);
@@ -700,6 +717,15 @@ export function AdminSettingsPanel() {
               onToggle={handleTogglePasswordLogin}
             />
           </SettingRow>
+          <SettingRow
+            label="OIDC Auto-Provision"
+            description="Auto-create accounts for OIDC users even when registration is disabled"
+          >
+            <AdminToggle
+              on={oidcAutoProvision}
+              onToggle={handleToggleOidcAutoProvision}
+            />
+          </SettingRow>
           <SettingRow
             label="Allow Password Reset"
             description="Reset code via Docker logs"