feat: add global auth settings and pending users

modules/core/server/store.ts

@@ -14,6 +14,7 @@ import {
   roles,
   rooms,
   sessions,
+  systemSettings,
   systemIncidents,
 } from "@/modules/core/server/schema";
 import type {
@@ -50,6 +51,7 @@ export async function readData(): Promise<AppData> {
     admissionRows,
     auditLogRows,
     incidentRows,
+    systemSettingsRows,
   ] = await Promise.all([
     database.select().from(organizations).orderBy(desc(organizations.createdAt)),
     database.select().from(accounts).orderBy(desc(accounts.createdAt)),
@@ -107,6 +109,7 @@ export async function readData(): Promise<AppData> {
       .orderBy(desc(admissions.admittedAt)),
     listAuditLogs({ limit: 100 }),
     database.select().from(systemIncidents).orderBy(desc(systemIncidents.createdAt)),
+    database.select().from(systemSettings).limit(1),
   ]);
 
   const roleById = new Map(membershipRows.map((row) => [row.membership.id, row.role]));
@@ -132,6 +135,7 @@ export async function readData(): Promise<AppData> {
     oidcHasClientSecret: row.oidcClientSecret.length > 0,
     oidcScopes: row.oidcScopes,
     oidcRedirectUri: row.oidcRedirectUri,
+    oidcAvatarClaim: row.oidcAvatarClaim,
     oidcAutoProvision: row.oidcAutoProvision,
     createdAt: iso(row.createdAt),
     updatedAt: iso(row.updatedAt),
@@ -142,6 +146,7 @@ export async function readData(): Promise<AppData> {
     platformRoleId: row.platformRoleId ?? undefined,
     name: row.name,
     email: row.email,
+    avatarUrl: row.avatarUrl,
     role: row.platformRoleId ?? "viewer",
     passwordHash: row.passwordHash,
     passwordSalt: row.passwordSalt,
@@ -276,7 +281,37 @@ export async function readData(): Promise<AppData> {
     updatedAt: iso(row.updatedAt),
   }));
 
+  const systemSettingsRow = systemSettingsRows[0];
+  const systemSettingsData = systemSettingsRow
+    ? {
+        id: systemSettingsRow.id,
+        registrationEnabled: systemSettingsRow.registrationEnabled,
+        oidcEnabled: systemSettingsRow.oidcEnabled,
+        oidcIssuerUrl: systemSettingsRow.oidcIssuerUrl,
+        oidcClientId: systemSettingsRow.oidcClientId,
+        oidcHasClientSecret: systemSettingsRow.oidcClientSecret.length > 0,
+        oidcScopes: systemSettingsRow.oidcScopes,
+        oidcRedirectUri: systemSettingsRow.oidcRedirectUri,
+        oidcAvatarClaim: systemSettingsRow.oidcAvatarClaim,
+        oidcAutoProvision: systemSettingsRow.oidcAutoProvision,
+        updatedAt: iso(systemSettingsRow.updatedAt),
+      }
+    : {
+        id: "global",
+        registrationEnabled: true,
+        oidcEnabled: false,
+        oidcIssuerUrl: "",
+        oidcClientId: "",
+        oidcHasClientSecret: false,
+        oidcScopes: "openid profile email",
+        oidcRedirectUri: "",
+        oidcAvatarClaim: "picture",
+        oidcAutoProvision: false,
+        updatedAt: new Date(0).toISOString(),
+      };
+
   return {
+    systemSettings: systemSettingsData,
     organizations: organizationsData,
     accounts: accountsData,
     memberships: membershipsData,