refactor: simplify SSO configuration and use standard provider logic

Revert custom provider detection logic in favor of using a placeholder OSEM_DISCOURSE_KEY. This aligns Snap!Cloud SSO with the existing OSEM provider pattern while documenting that only the secret is required for the actual handshake.

Co-authored-by: Claude Code <noreply@anthropic.com>

Author: 2 people

app/helpers/users_helper.rb

@@ -14,12 +14,6 @@ def omniauth_configured
 
     providers = []
     Devise.omniauth_providers.each do |provider|
-      # Discourse SSO (Snap!Cloud) only requires a secret, not a key
-      if provider == :discourse
-        providers << provider if ENV.fetch('OSEM_SNAP_SSO_SECRET', ENV.fetch('OSEM_DISCOURSE_SECRET', nil)).present?
-        next
-      end
-
       provider_key = "#{provider}_key"
       provider_secret = "#{provider}_secret"
       unless Rails.application.secrets.send(provider_key).blank? || Rails.application.secrets.send(provider_secret).blank?

config/initializers/devise.rb

@@ -16,7 +16,7 @@
 
   config.omniauth :discourse,
                   sso_url:    ENV.fetch('OSEM_SNAP_SSO_URL', 'https://snap.berkeley.edu/api/v1/discourse-sso'),
-                  sso_secret: ENV.fetch('OSEM_SNAP_SSO_SECRET', ENV.fetch('OSEM_DISCOURSE_SECRET', nil))
+                  sso_secret: ENV.fetch('OSEM_DISCOURSE_SECRET', nil)
 
   config.omniauth :facebook,
                   ENV.fetch('OSEM_FACEBOOK_KEY', Rails.application.secrets.facebook_key),

dotenv.example

@@ -67,9 +67,12 @@
 # OSEM_GITHUB_KEY=1234
 # OSEM_GITHUB_SECRET=5678
 
-# Snap!Cloud SSO (Discourse SSO protocol)
-# The shared secret must match the DISCOURSE_SSO_SECRET configured in Snap!Cloud
-# OSEM_SNAP_SSO_SECRET=your_shared_secret
+# Snap!Cloud SSO (uses the Discourse SSO protocol)
+# The shared secret must match the DISCOURSE_SSO_SECRET configured in Snap!Cloud.
+# OSEM_DISCOURSE_KEY can be any non-empty value; it is only used to signal that
+# the Discourse provider is enabled (the SSO flow itself only needs the secret).
+# OSEM_DISCOURSE_KEY=snap-cloud
+# OSEM_DISCOURSE_SECRET=your_shared_secret
 # Optionally override the SSO endpoint URL (defaults to https://snap.berkeley.edu/api/v1/discourse-sso)
 # OSEM_SNAP_SSO_URL=https://snap.berkeley.edu/api/v1/discourse-sso
 

spec/support/omniauth_macros.rb

@@ -12,7 +12,8 @@ module OmniauthMacros
   ENV['OSEM_SUSE_SECRET'] = 'test secret suse'
   ENV['OSEM_GITHUB_KEY'] = 'test key github'
   ENV['OSEM_GITHUB_SECRET'] = 'test secret github'
-  ENV['OSEM_SNAP_SSO_SECRET'] = 'test secret snap sso'
+  ENV['OSEM_DISCOURSE_KEY'] = 'snap-cloud'
+  ENV['OSEM_DISCOURSE_SECRET'] = 'test secret discourse'
 
   def mock_auth_new_user
     OmniAuth.config.mock_auth[:google] =