Summary

• What changed: GET /api/auth/:strategy and its /callback route no longer pass req.params.strategy straight into passport.authenticate(). A new isEnabledOAuthProvider() guard rejects any strategy name that is not both allowlisted (ALLOWED_PROVIDERS) and actually registered with passport, returning a clean 404 (OAUTH_PROVIDER_NOT_FOUND) instead of a synchronous throw. oauthCall now also passes { session: false } to passport.authenticate() (stateless JWT stack, no express-session middleware mounted).
• Why: any unmatched path segment under /api/auth/* was reaching passport.authenticate(strategy) unguarded. An unknown name (e.g. probe traffic hitting /api/auth/me) made passport throw synchronously ("Unknown authentication strategy") → 500. A provider that's allowlisted but not registered (missing credentials) hit the same throw. An actually-registered provider defaulted to session: true and would fail immediately with "Login sessions require session support" on a stack with no session middleware. This closes all three off as clean, testable 404s / correct stateless auth.
• Related issues: Closes 🔒 fix(auth): guard OAuth :strategy route — 404 unknown/disabled provider + stateless authenticate #3900

Scope

• Module(s) impacted: modules/auth (controller only — no route/schema changes)
• Cross-module impact: none — the one line touched outside modules/auth is a pre-existing modules/invitations integration test assertion that exercises the same /api/auth/google route; it now asserts the new deliberate 404 contract instead of "any non-404", no invitations module logic changed.
• Risk level: low

Validation

• npm run lint
• npm test
• Manual checks done (if applicable)

Guardrails check

• No secrets or credentials introduced (.env*, secrets/**, keys, tokens)
• No risky rename/move of core stack paths
• Changes remain merge-friendly for downstream projects
• Tests added or updated when behavior changed

Reviewer notes

• The guard uses passport._strategy(strategy) — this is @api private in passport, but it is the only source-of-truth for "is this strategy registered" in passport@0.7.0 (no public accessor exists; only use()/unuse()). A config-based check would duplicate each provider's own credential-presence gating (strategies/local/{google,apple}.js) and risk drift. Deliberate trade-off, documented inline on isEnabledOAuthProvider().
• { session: false } is passed to passport.authenticate in oauthCall (the default session: true was the root cause of the "Login sessions require session support" error on this stateless-JWT stack). It is intentionally not added to oauthCallback — passport's callback form (passport.authenticate(strategy, callback)) never calls req.logIn() / reads options.session, so it would be a dead option there. Both are commented inline for the next reader.
• A 4-lens adversarial pre-push review already ran on this diff (security + correctness clean). It found 2 test-coverage gaps, both fixed before this PR was opened: oauthCallback's 404-guard branch is now covered by the new unit test file, and a pre-existing session-mint regression test (identity-trust logic) had its coverage restored past the new guard so it still reaches the code it was written to protect.

Notes for reviewers

• Security considerations: this closes an unauthenticated-request path that could throw synchronously past intended error handling (500 on probe traffic); no new attack surface is introduced — the guard is strictly more restrictive than the previous unguarded call.
• Mergeability considerations: none — isolated to modules/auth, no shared lib//config/ changes.
• Follow-up tasks (optional): none.

Summary by CodeRabbit

• Bug Fixes

  • OAuth sign-in and callback routes now reject unsupported or unregistered providers with a clear 404 error.
  • OAuth authentication is now handled more safely in stateless mode, reducing the chance of unwanted session behavior.
  • Existing login flows continue to redirect properly on authentication failures, with improved route handling for legacy paths.

• Tests

  • Expanded coverage for OAuth provider validation and callback behavior.
  • Strengthened integration checks to prevent mock leakage and verify the correct error response.