Meteor’s own accounts packages - accounts-google, accounts-github, accounts-facebook, accounts-twitter, accounts-meteor-developer, accounts-weibo, accounts-meetup and accounts-passwordless - are added, so every login method Meteor’s accounts system offers is now in WeKan beside password, 2FA, OIDC, LDAP, CAS and SAML.

models/lib/oauthProviders.js is the pure catalog of the seven providers: the OAUTH_<PROVIDER>_ENABLED, _CLIENT_ID (_APP_ID for Facebook, _CONSUMER_KEY for X) and _SECRET env vars, each credential also read from a <NAME>_FILE Docker secret; the shared OAUTH_PROVIDERS_LOGIN_STYLE (popup or redirect) and OAUTH_PROVIDERS_MERGE_EXISTING_USERS; and PASSWORDLESS_ENABLED. An Admin Panel value wins over the env var, and a provider is enabled only with the flag AND both credentials.

server/lib/oauthProviders.js writes Meteor’s ServiceConfiguration for every enabled provider at startup and whenever the Admin Panel saves, and REMOVES it for a disabled one, so switching a provider off takes effect without a restart. A first login through a provider becomes a WeKan user the way OIDC does, fail-closed: an existing account made by another login method is linked only when merging is on and the provider verified the address; otherwise the login is refused with oauth-account-conflict and the attempt is recorded on the new oauth.account-conflict canary, so Admin Panel -> Problems shows who tried. Passwordless is refused at both the token-request method and the login attempt while it is off, so the package cannot create accounts or send codes when nobody enabled it.

The login form shows one button per enabled provider under the SAML button, and a two-step “Email me a sign-in code” form (address, then code) when passwordless is on; errors land in the same region as the password form. getAuthenticationsEnabled reports keys only - no credential ever reaches a browser. tests/oauthProviders.test.cjs pins the catalog shape, the env, _FILE and Admin Panel resolution, the enabled and takeover decisions, the upsert/remove, the canary, the form and the negative no-secret-on-the-client sweep.

Admin Panel / People / Login gets a section for Meteor’s own accounts-* login services (Google, GitHub, Facebook, X/Twitter, Meteor Developer, Weibo, Meetup) and for passwordless login, built the same way as the LDAP section above it: every OAUTH_<PROVIDER>_ENABLED / _CLIENT_ID / _SECRET env var, the shared OAUTH_PROVIDERS_LOGIN_STYLE and OAUTH_PROVIDERS_MERGE_EXISTING_USERS, and PASSWORDLESS_ENABLED can be set there, a value set in the Admin Panel wins over the env var (models/lib/configResolver.js), and a badge beside each field says whether the env var, the Admin Panel or nothing is in effect.

The secret is stored in Settings.oauthProviders.<key>.secret and, like the LDAP bind password, never reaches a browser: the setting publication carries only enabled, id, loginStyle and the boolean secretSet per provider, an empty secret submission leaves the stored one untouched, and the sources method reports the secret through hasConfigValue() as “is set (source)” only. saveOauthProviderSettings validates the provider key against the catalog, and both it and savePasswordlessSettings are admin-only and call reconfigureOauthProviders() so a change takes effect without a server restart.

tests/oauthProvidersAdminOverride.test.cjs pins the schema, the published field list (secret absent, secretSet present), the admin gate, the key validation, the empty-secret rule, the reconfigure call and the jade badges; the whole-tree secret sweep in tests/ldapAdminOverrideSecurity.test.cjs now also matches hyphenated sub-document keys such as oauthProviders.meteor-developer.secret.

A setting that exists in the code but not where a user configures WeKan is invisible, so OAUTH_<PROVIDER>_ENABLED / _CLIENT_ID (_APP_ID for Facebook, _CONSUMER_KEY for Twitter) / _SECRET / _SECRET_FILE for Google, GitHub, Facebook, Twitter, Meteor Developer, Weibo and Meetup, OAUTH_PROVIDERS_LOGIN_STYLE, OAUTH_PROVIDERS_MERGE_EXISTING_USERS and PASSWORDLESS_ENABLED now appear, commented out with the same explanation, everywhere the OAUTH2_* and SAML_* settings already do: docker-compose.yml and its FerretDB v1 (PostgreSQL, MySQL, MariaDB, SAP HANA), FerretDB v2 and MongoDB variants, the Dockerfile and devcontainer ENV block (every *_ENABLED defaulting to false, login style to popup), start-wekan.sh, start-wekan.bat, the Snap’s config (keys list plus a DESCRIPTION_/DEFAULT_/KEY_ triple each, so snap set wekan oauth-google-enabled='true' works) and wekan-help, the Sandstorm package definition, the stacksmith Docker-secrets reader, secrets/README.md and the Helm chart’s values.yaml in wekan/charts. Each comment names the callback URL to register at the provider, <ROOT_URL>/_oauth/<service>, and says that Admin Panel / People / Login overrides the environment.

Two new docs pages: OAuth Providers (where to create the app at each provider, the callback URL, the variables, the Admin Panel section, login style, merging, troubleshooting) and Passwordless, both linked from the docs index. tests/oauthProvidersPlatformEnv.test.cjs pins every variable on every platform, the Snap triples and their kebab-case keys, the Sandstorm defaults, and that the docs pages exist and are linked; the compose-parity suite keeps the five FerretDB v1 files identical.

The bump job of release-all.yml regenerates public/api/wekan.yml from the models’ JSDoc and renders it with @redocly/cli, which stopped the release with “bad indentation of a mapping entry (1232:2)”. A @param whose description continues on the next JSDoc lines (the chart export’s chartKey) was emitted under description: | with only its first line indented, so the continuation lines fell out of the block scalar and the whole spec failed to parse. The generator now indents every line. It also stopped warning “unknown type object” for the rules API’s trigger/action parameters: OpenAPI 2.0 has no object for a path/query/form parameter, so they are emitted as a JSON string. Reproduced locally and verified with the same @redocly/cli render; tests/openapiParamMultiline.test.cjs pins the emitter and parses the regenerated spec.