Fixes

Author: GitTimeraider

app/__init__.py

@@ -194,6 +194,76 @@ def migrate_database():
             except Exception as e:
                 print(f"⚠️ Could not create oidc_settings table (may already exist): {e}")
 
+        # Migration 5: Add manual endpoint columns to oidc_settings if they don't exist
+        if inspector.has_table('oidc_settings'):
+            oidc_columns = [col['name'] for col in inspector.get_columns('oidc_settings')]
+            
+            if 'authorization_endpoint' not in oidc_columns:
+                try:
+                    if db_dialect == 'postgresql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN authorization_endpoint VARCHAR(500)'
+                    elif db_dialect == 'mysql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN authorization_endpoint VARCHAR(500)'
+                    else:  # SQLite
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN authorization_endpoint VARCHAR(500)'
+                    
+                    with db.engine.connect() as conn:
+                        conn.execute(text(alter_sql))
+                        conn.commit()
+                    migrations_applied.append("Added authorization_endpoint column to oidc_settings")
+                except Exception as e:
+                    print(f"⚠️ Could not add authorization_endpoint column: {e}")
+            
+            if 'token_endpoint' not in oidc_columns:
+                try:
+                    if db_dialect == 'postgresql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN token_endpoint VARCHAR(500)'
+                    elif db_dialect == 'mysql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN token_endpoint VARCHAR(500)'
+                    else:  # SQLite
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN token_endpoint VARCHAR(500)'
+                    
+                    with db.engine.connect() as conn:
+                        conn.execute(text(alter_sql))
+                        conn.commit()
+                    migrations_applied.append("Added token_endpoint column to oidc_settings")
+                except Exception as e:
+                    print(f"⚠️ Could not add token_endpoint column: {e}")
+            
+            if 'userinfo_endpoint' not in oidc_columns:
+                try:
+                    if db_dialect == 'postgresql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN userinfo_endpoint VARCHAR(500)'
+                    elif db_dialect == 'mysql':
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN userinfo_endpoint VARCHAR(500)'
+                    else:  # SQLite
+                        alter_sql = 'ALTER TABLE oidc_settings ADD COLUMN userinfo_endpoint VARCHAR(500)'
+                    
+                    with db.engine.connect() as conn:
+                        conn.execute(text(alter_sql))
+                        conn.commit()
+                    migrations_applied.append("Added userinfo_endpoint column to oidc_settings")
+                except Exception as e:
+                    print(f"⚠️ Could not add userinfo_endpoint column: {e}")
+            
+            # Make discovery_endpoint nullable
+            try:
+                # Note: SQLite doesn't support ALTER COLUMN, so this only works for PostgreSQL/MySQL
+                if db_dialect == 'postgresql':
+                    alter_sql = 'ALTER TABLE oidc_settings ALTER COLUMN discovery_endpoint DROP NOT NULL'
+                    with db.engine.connect() as conn:
+                        conn.execute(text(alter_sql))
+                        conn.commit()
+                    migrations_applied.append("Made discovery_endpoint nullable in oidc_settings")
+                elif db_dialect == 'mysql':
+                    alter_sql = 'ALTER TABLE oidc_settings MODIFY discovery_endpoint VARCHAR(500)'
+                    with db.engine.connect() as conn:
+                        conn.execute(text(alter_sql))
+                        conn.commit()
+                    migrations_applied.append("Made discovery_endpoint nullable in oidc_settings")
+            except Exception as e:
+                print(f"⚠️ Could not make discovery_endpoint nullable (may already be nullable or SQLite): {e}")
+        
         if migrations_applied:
             print("🔄 Database migrations applied:")
             for migration in migrations_applied:

app/forms.py

@@ -191,11 +191,17 @@ def validate_url(self, field):
 
 class OIDCSettingsForm(FlaskForm):
     display_name = StringField('OIDC Display Name', validators=[DataRequired(), Length(min=1, max=100)],
-                              render_kw={'placeholder': 'e.g., Company SSO, Keycloak, etc.'})
+                              render_kw={'placeholder': 'e.g., VoidAuth, Company SSO, etc.'})
     client_id = StringField('Client ID', validators=[DataRequired(), Length(min=1, max=500)])
     client_secret = StringField('Client Secret', validators=[DataRequired(), Length(min=1, max=500)])
-    discovery_endpoint = StringField('Discovery Endpoint URL', validators=[DataRequired(), Length(min=1, max=500)],
+    discovery_endpoint = StringField('Discovery Endpoint URL (Leave blank if blocked/restricted)', validators=[Optional(), Length(max=500)],
                                     render_kw={'placeholder': 'https://your-idp.com/.well-known/openid-configuration'})
+    authorization_endpoint = StringField('Authorization Endpoint (Required if discovery blocked)', validators=[Optional(), Length(max=500)],
+                                        render_kw={'placeholder': 'https://void.madnessshell.com/oidc/authorize'})
+    token_endpoint = StringField('Token Endpoint (Required if discovery blocked)', validators=[Optional(), Length(max=500)],
+                                render_kw={'placeholder': 'https://void.madnessshell.com/oidc/token'})
+    userinfo_endpoint = StringField('UserInfo Endpoint (Required if discovery blocked)', validators=[Optional(), Length(max=500)],
+                                   render_kw={'placeholder': 'https://void.madnessshell.com/oidc/userinfo'})
     user_mapping_field = SelectField('User Mapping Field',
                                     choices=[('username', 'Username'),
                                            ('email', 'Email'),
@@ -206,10 +212,24 @@ class OIDCSettingsForm(FlaskForm):
                                   render_kw={'placeholder': 'e.g., preferred_username, sub, etc.'})
     is_enabled = BooleanField('Enable OIDC Authentication', default=False)
 
-    def validate_discovery_endpoint(self, field):
-        if not (field.data.startswith('http://') or field.data.startswith('https://')):
-            raise ValidationError('Discovery endpoint must start with http:// or https://')
-    
-    def validate_custom_attribute(self, field):
-        if self.user_mapping_field.data == 'custom' and not field.data:
-            raise ValidationError('Custom attribute name is required when using custom mapping')
+    def validate(self, extra_validators=None):
+        if not super().validate(extra_validators):
+            return False
+        
+        # Either discovery endpoint OR all manual endpoints must be provided
+        has_discovery = bool(self.discovery_endpoint.data)
+        has_manual = bool(self.authorization_endpoint.data and self.token_endpoint.data and self.userinfo_endpoint.data)
+        
+        if not has_discovery and not has_manual:
+            self.discovery_endpoint.errors.append('Either provide Discovery Endpoint OR all three manual endpoints (Authorization, Token, UserInfo)')
+            return False
+        
+        if has_discovery and not (self.discovery_endpoint.data.startswith('http://') or self.discovery_endpoint.data.startswith('https://')):
+            self.discovery_endpoint.errors.append('Discovery endpoint must start with http:// or https://')
+            return False
+        
+        if self.user_mapping_field.data == 'custom' and not self.custom_attribute.data:
+            self.custom_attribute.errors.append('Custom attribute name is required when using custom mapping')
+            return False
+        
+        return True