Upravil jsem Google OAuth tak, že Google uživatel se hledá/vytváří přes email, ukládá auth_provider='google', provider_subject, display_name, avatar_url a po úspěšném loginu last_login_at. První Google uživatel v prázdné users tabulce dostane admin, další noví Google uživatelé viewer.

Přidal jsem AUTH_MODE=google|mixed|local:

google: jen Google login, lokální/Gitea nejdou ani přes přímý endpoint
mixed: Google + lokální/Gitea fallback
local: jen lokální login
Správa uživatelů zůstává admin-only, guard posledního admina platí pro odebrání role i deaktivaci. Přidal jsem do ní i přehled oprávnění rolí a zobrazení provider/avatar metadat.

DB migrace teď přes PRAGMA table_info(users) doplňuje chybějící sloupce bez mazání/recreate existující tabulky; pokud users vůbec neexistuje, bezpečně ji vytvoří. Podporované sloupce zahrnují email, display_name, role, is_enabled, created_at, updated_at, last_login_at, auth_provider, provider_subject, plus kompatibilní sloupce pro lokální login.

app/auth.py

@@ -17,10 +17,21 @@ def _table_columns(con, table_name: str) -> set[str]:
 def _user_select_columns(con) -> str:
     columns = _table_columns(con, "users")
     enabled_select = "COALESCE(is_enabled, 1) AS is_enabled" if "is_enabled" in columns else "1 AS is_enabled"
-    return f"id, username, display_name, email, password_hash, role, is_active, {enabled_select}, created_at, updated_at"
+    optional_columns = []
+    for column in ("last_login_at", "auth_provider", "provider_subject", "avatar_url"):
+        if column in columns:
+            optional_columns.append(column)
+        else:
+            optional_columns.append(f"NULL AS {column}")
+    return (
+        "id, username, display_name, email, password_hash, role, "
+        f"is_active, {enabled_select}, created_at, updated_at, "
+        + ", ".join(optional_columns)
+    )
 
 
 def mark_last_login(user_id: int) -> None:
+    run_migrations()
     con = get_connection()
     columns = _table_columns(con, "users")
     if "last_login_at" in columns:
@@ -125,6 +136,101 @@ def find_or_create_oauth_user(username: str, display_name: str, email: str) -> d
     return dict(user)
 
 
+def find_or_create_google_user(email: str, display_name: str, provider_subject: str, avatar_url: str = "") -> tuple[dict[str, Any], bool]:
+    email = email.strip().lower()
+    display_name = (display_name or email).strip() or email
+    provider_subject = (provider_subject or "").strip()
+    avatar_url = (avatar_url or "").strip()
+
+    run_migrations()
+    con = get_connection()
+    columns = _table_columns(con, "users")
+    params: list[Any] = [email, email]
+    provider_clause = ""
+    if provider_subject:
+        provider_clause = " OR (auth_provider = 'google' AND provider_subject = ?)"
+        params.append(provider_subject)
+
+    row = con.execute(
+        f"""
+        SELECT {_user_select_columns(con)}
+        FROM users
+        WHERE LOWER(COALESCE(email, '')) = ?
+           OR LOWER(COALESCE(username, '')) = ?
+           {provider_clause}
+        ORDER BY
+            CASE
+                WHEN LOWER(COALESCE(email, '')) = ? THEN 0
+                WHEN LOWER(COALESCE(username, '')) = ? THEN 1
+                ELSE 2
+            END,
+            id
+        LIMIT 1
+        """,
+        (*params, email, email),
+    ).fetchone()
+
+    if row:
+        updates = [
+            "display_name = ?",
+            "email = ?",
+            "auth_provider = 'google'",
+            "provider_subject = ?",
+            "updated_at = CURRENT_TIMESTAMP",
+        ]
+        values: list[Any] = [display_name, email, provider_subject]
+        if "avatar_url" in columns:
+            updates.append("avatar_url = ?")
+            values.append(avatar_url)
+        values.append(row["id"])
+        con.execute(f"UPDATE users SET {', '.join(updates)} WHERE id = ?", values)
+        created = False
+        user_id = row["id"]
+    else:
+        role = "admin" if con.execute("SELECT COUNT(*) AS count FROM users").fetchone()["count"] == 0 else "viewer"
+        insert_columns = [
+            "username",
+            "display_name",
+            "email",
+            "password_hash",
+            "role",
+            "is_active",
+            "is_enabled",
+            "auth_provider",
+            "provider_subject",
+            "created_at",
+            "updated_at",
+        ]
+        values = [email, display_name, email, "", role, 1, 1, "google", provider_subject]
+        placeholders = ["?", "?", "?", "?", "?", "?", "?", "?", "?", "CURRENT_TIMESTAMP", "CURRENT_TIMESTAMP"]
+        if "avatar_url" in columns:
+            insert_columns.append("avatar_url")
+            values.append(avatar_url)
+            placeholders.append("?")
+        con.execute(
+            f"""
+            INSERT INTO users ({', '.join(insert_columns)})
+            VALUES ({', '.join(placeholders)})
+            """,
+            values,
+        )
+        created = True
+        user_id = con.execute("SELECT last_insert_rowid() AS id").fetchone()["id"]
+
+    con.commit()
+    user = con.execute(
+        f"""
+        SELECT {_user_select_columns(con)}
+        FROM users
+        WHERE id = ?
+        """,
+        (user_id,),
+    ).fetchone()
+
+    con.close()
+    return dict(user), created
+
+
 def get_user_by_id(user_id: int) -> dict[str, Any] | None:
     run_migrations()
     con = get_connection()