fix(auth): gate OAuth user creation behind config.sign.up (#3503) (#3507)

* fix(auth): gate OAuth user creation behind config.sign.up (#3503)

`checkOAuthUserProfile` branch 4 (create new user) now returns a
VALIDATION_ERROR when `config.sign.up` is false — matching the local
signup endpoint's behavior. Branches 1-3 (primary lookup, linked
identity, link-on-verified-email) remain open so existing users can
always sign in, even during a signup freeze. The freeze only applies
to fresh account creation via OAuth.

Closes #3503

* fix(auth): align OAuth signup-disabled error with local signup + capture original config in test

Address reviewer feedback on #3507:
- Copilot (auth.controller.js): Use AppError message 'Signup error' to
  match the local signup endpoint (`signup` above), so clients see the
  same user-facing `message`/`description` regardless of signup method.
- Copilot (auth.integration.tests.js): Capture `config.sign.up` in
  beforeEach and restore in afterEach instead of hard-coding `true`, so
  tests do not leak state when the original value is not `true`
  (consistent with the /api/auth/config suite pattern).

Author: PierreBrisorgueil

modules/auth/controllers/auth.controller.js

@@ -372,6 +372,14 @@ const checkOAuthUserProfile = async (profil, key, provider) => {
   }
   // 4. No match → create new user
   try {
+    if (!config.sign.up) {
+      // Mirror the local signup endpoint's error shape so clients see the same
+      // `message`/`description` regardless of signup method (see `signup` above).
+      throw new AppError('Signup error', {
+        code: 'VALIDATION_ERROR',
+        details: { message: 'Registration is currently deactivated' },
+      });
+    }
     const user = {
       firstName: profil.firstName,
       lastName: profil.lastName,

modules/auth/tests/auth.integration.tests.js

@@ -892,6 +892,127 @@ describe('Auth integration tests:', () => {
       ).rejects.toMatchObject({ code: 'VALIDATION_ERROR' });
     });
 
+    describe('signup gate (config.sign.up = false)', () => {
+      let originalSignUpConfig;
+
+      beforeEach(() => {
+        originalSignUpConfig = config.sign.up;
+      });
+
+      afterEach(() => {
+        config.sign.up = originalSignUpConfig;
+      });
+
+      test('should reject new OAuth user creation when signup is disabled (branch 4)', async () => {
+        config.sign.up = false;
+        const email = 'oauth-signup-gate-new@test.com';
+        const profil = {
+          firstName: 'Gated',
+          lastName: 'Signup',
+          email,
+          avatar: '',
+          providerData: { sub: 'google-gated-sub-3503' },
+          emailVerifiedByProvider: false,
+        };
+        await expect(
+          AuthController.checkOAuthUserProfile(profil, 'sub', 'google'),
+        ).rejects.toMatchObject({
+          code: 'VALIDATION_ERROR',
+          details: { message: 'Registration is currently deactivated' },
+        });
+        // Ensure no user was persisted
+        const users = await UserService.search({ email });
+        expect(users.length).toBe(0);
+      });
+
+      test('should allow existing OAuth-first user to sign in when signup disabled (branch 1)', async () => {
+        const email = 'oauth-signup-gate-b1@test.com';
+        const existing = await UserService.create({
+          firstName: 'Branch',
+          lastName: 'One',
+          email,
+          provider: 'google',
+          providerData: { sub: 'google-gated-b1-sub' },
+          roles: ['user'],
+        });
+        config.sign.up = false;
+        const profil = {
+          firstName: 'Branch',
+          lastName: 'One',
+          email,
+          avatar: '',
+          providerData: { sub: 'google-gated-b1-sub' },
+        };
+        const found = await AuthController.checkOAuthUserProfile(profil, 'sub', 'google');
+        expect(found).toBeDefined();
+        expect(found.id).toBe(existing.id);
+
+        try { await UserService.remove(existing); } catch (_) { /* cleanup */ }
+      });
+
+      test('should allow linked OAuth user to sign in when signup disabled (branch 2)', async () => {
+        const email = 'oauth-signup-gate-b2@test.com';
+        const localUser = await UserService.create({
+          firstName: 'Branch',
+          lastName: 'Two',
+          email,
+          password: 'W@os.jsI$Aw3$0m3',
+          provider: 'local',
+          roles: ['user'],
+        });
+        // Inject additionalProvidersData to simulate a pre-linked account
+        const brutLocal = await UserService.getBrut({ email });
+        await UserService.update(brutLocal, {
+          additionalProvidersData: {
+            google: { sub: 'google-gated-b2-sub', email_verified: true },
+          },
+        }, 'recover');
+
+        config.sign.up = false;
+        const profil = {
+          firstName: 'Branch',
+          lastName: 'Two',
+          email,
+          avatar: '',
+          providerData: { sub: 'google-gated-b2-sub' },
+        };
+        const found = await AuthController.checkOAuthUserProfile(profil, 'sub', 'google');
+        expect(found).toBeDefined();
+        expect(found.id).toBe(localUser.id);
+
+        try { await UserService.remove(localUser); } catch (_) { /* cleanup */ }
+      });
+
+      test('should link local user via verified email when signup disabled (branch 3)', async () => {
+        const email = 'oauth-signup-gate-b3@test.com';
+        const localUser = await UserService.create({
+          firstName: 'Branch',
+          lastName: 'Three',
+          email,
+          password: 'W@os.jsI$Aw3$0m3',
+          provider: 'local',
+          roles: ['user'],
+        });
+
+        config.sign.up = false;
+        const profil = {
+          firstName: 'Branch',
+          lastName: 'Three',
+          email,
+          avatar: '',
+          providerData: { sub: 'google-gated-b3-sub', email_verified: true },
+          emailVerifiedByProvider: true,
+        };
+        const linked = await AuthController.checkOAuthUserProfile(profil, 'sub', 'google');
+        expect(linked).toBeDefined();
+        expect(linked.id).toBe(localUser.id);
+        const brutLinked = await UserService.getBrut({ id: linked.id });
+        expect(brutLinked.additionalProvidersData?.google?.sub).toBe('google-gated-b3-sub');
+
+        try { await UserService.remove(linked); } catch (_) { /* cleanup */ }
+      });
+    });
+
     test('token endpoint should strip accessToken/refreshToken from additionalProvidersData', async () => {
       // Create a local user then sign in to get an auth cookie
       const localEmail = 'token-sanitize@test.com';