feat(auth): add a generic OIDC provider

[mxzinke]

Self-hosted instances can use Google, Apple and WorkOS today, but none of those work with an identity provider the operator runs themselves. This adds a generic OpenID Connect provider.

NextAuth already speaks OIDC, so this declares a provider from the discovery document rather than adding a dependency or a second code path. Closes the gap asked about in #914.

Usage

Set all three to show the button, leave any unset and nothing changes:

OIDC_ISSUER=https://id.example.com
OIDC_CLIENT_ID=...
OIDC_CLIENT_SECRET=...
OIDC_NAME=Example SSO      # optional, labels the button, defaults to "SSO"

OIDC_ISSUER is the base URL whose /.well-known/openid-configuration describes the endpoints, so any conformant provider works without further code.

Scope

81 lines across five files: the env schema, the provider, the public-env flag and the login button. No new dependency, no change to existing providers, no migration.

Two decisions worth calling out:

• Email account linking is enabled, matching the WorkOS provider directly above it. An operator who configures this controls the issuer and its email claim, and without it an instance that already has email-code users cannot move them to SSO.
• Signup restrictions already apply. The signIn callback keys on the address rather than the provider, so CAP_ALLOWED_SIGNUP_DOMAINS and the block list cover this provider with no extra code.

Deliberately not included, to keep the change small: the signup page and the share-page auth overlay keep their current buttons. New users sign in through /login and the account is created on first sign-in, so the flow is complete without them. Happy to add either if you would rather have them in the same PR.

Testing

I do not have a working build of the monorepo available, so this is reviewed rather than built: each touched file parses, and the provider follows the shape NextAuth v4 documents for a custom OIDC provider (wellKnown plus idToken). Please treat the CI run as the real check.

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues were found.

Summary

Adds a generic OIDC provider for self-hosted instances.

• Self-hosted logins can use an operator's OIDC issuer.

The previous and current commits have different merge bases with the target commit, so this review used the full PR diff. No build or runtime checks were performed.

_{Reviews (2) · Last reviewed commit: "Merge branch 'CapSoftware:main' into fea..." · Reviewed by Greptile}

[richiemcilroy]

Thanks, this looks like a clean approach. We require Greptile 5/5 on the latest commit and green CI before review, so please trigger a Greptile re-review now that account linking requires a verified email.

[mxzinke]

@richiemcilroy I get a 404 when trying to retrigger. Can you retrigger for me?

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 18, 2026 5:08pm UTC

[mxzinke]

@richiemcilroy Anything open from your point of view? Can you help me finish this PR up?

[richiemcilroy]

Thanks @mxzinke! Greptile is at 2/5 here. We only merge once Greptile reaches 5/5, so please address its findings in the summary above (or reply to them if you think one is wrong), then comment @greptileai review to re-run it. If the branch is behind main, please merge or rebase on main first. Once it is 5/5 we will run the full verification suite on it.

[mxzinke]

@greptileai review

[mxzinke]

@richiemcilroy Ready for review! Greptile 5/5