RocketChat / RocketChat/Rocket.Chat

bug(oauth): custom OAuth show_button=false is ignored and always saved as true

Open
#39,381 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Custom OAuth show_button cannot be reliably set to false during provider initialization.
When _show_button=false is provided, the setting is still persisted as true, so the login button remains visible.

Steps to reproduce:
  1. Set environment variables for a custom OAuth provider, for example:
    • Accounts_OAuth_Custom_Github=true
    • Accounts_OAuth_Custom_Github_show_button=false
  2. Start Rocket.Chat.
  3. Open Administration > Settings > OAuth > Custom OAuth: Github and check show_button value.
  4. Check login page provider visibility.
Expected behavior:

If Accounts_OAuth_Custom_<Provider>_show_button=false is set, the provider login button should be hidden (show_button=false persisted).

Actual behavior:

show_button is persisted as true, so the provider login button is still shown.

Server Setup Information:
  • Version of Rocket.Chat Server: 8.3.0-develop
  • License Type: N/A
  • Number of Users: N/A
  • Operating System: N/A
  • Deployment Method: docker/env-based setup
  • Number of Running Instances: N/A
  • DB Replicaset Oplog: N/A
  • NodeJS Version: N/A
  • MongoDB Version: N/A
Client Setup Information
  • Desktop App or Browser Version: Any
  • Operating System: Any
Additional context

Code path involved:

  • apps/meteor/server/lib/oauth/initCustomOAuthServices.ts passes showButton from env.
  • apps/meteor/server/lib/oauth/addOAuthService.ts uses values.showButton || true for Accounts_OAuth_Custom-<name>-show_button, which converts explicit false to true.
Relevant logs:

N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with apps/meteor/server/lib/oauth/initCustomOAuthServices.ts and apps/meteor/server/lib/oauth/addOAuthService.ts, tracing how the environment value reaches Accounts_OAuth_Custom--show_button. Verify that an explicit false remains false, then check the Administration OAuth setting and login-page provider visibility to confirm the reported behavior is fixed.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.