feat: Remove OIDC and SSO support

Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.

server/db/migrations/20260807120000_remove_single_sign_on_support.js

@@ -0,0 +1,51 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+/*
+ * Single sign-on support has been removed. Accounts that were provisioned through an
+ * identity provider have no local password, so they would silently become unusable once
+ * the flag is gone. They are deactivated first, which makes their state visible in the
+ * administration UI: an admin can set a password and reactivate them afterwards.
+ *
+ * The down migration restores the schema, but not the data - the provider links and the
+ * information about which accounts were externally managed are gone for good.
+ */
+
+module.exports.up = async (knex) => {
+  await knex('user_account').where('is_sso_user', true).update({
+    is_deactivated: true,
+  });
+
+  await knex.schema.dropTable('identity_provider_user');
+
+  return knex.schema.alterTable('user_account', (table) => {
+    table.dropColumn('is_sso_user');
+  });
+};
+
+module.exports.down = async (knex) => {
+  await knex.schema.alterTable('user_account', (table) => {
+    table.boolean('is_sso_user').notNullable().defaultTo(false);
+  });
+
+  return knex.schema.createTable('identity_provider_user', (table) => {
+    /* Columns */
+
+    table.bigInteger('id').primary().defaultTo(knex.raw('next_id()'));
+
+    table.bigInteger('user_id').notNullable();
+
+    table.text('issuer').notNullable();
+    table.text('sub').notNullable();
+
+    table.timestamp('created_at', true);
+    table.timestamp('updated_at', true);
+
+    /* Indexes */
+
+    table.unique(['issuer', 'sub']);
+    table.index('user_id');
+  });
+};

server/db/seeds/default.js

@@ -8,7 +8,6 @@ const bcrypt = require('bcrypt');
 const buildUserData = () => {
   const data = {
     role: 'admin',
-    isSsoUser: false,
     isDeactivated: false,
   };
 

server/db/upgrade.js

@@ -89,7 +89,6 @@ const upgradeDatabase = async () => {
       ALTER TABLE migration_lock SET SCHEMA v1;
       ALTER TABLE archive SET SCHEMA v1;
       ALTER TABLE user_account SET SCHEMA v1;
-      ALTER TABLE identity_provider_user SET SCHEMA v1;
       ALTER TABLE session SET SCHEMA v1;
       ALTER TABLE project SET SCHEMA v1;
       ALTER TABLE project_manager SET SCHEMA v1;
@@ -147,20 +146,11 @@ const upgradeDatabase = async () => {
             default_editor_mode: User.EditorModes.WYSIWYG,
             default_home_view: User.HomeViews.GROUPED_PROJECTS,
             default_projects_order: User.ProjectOrders.BY_DEFAULT,
-            is_sso_user: user.is_sso,
             is_deactivated: false,
           })),
         )
         .transacting(trx);
 
-      const identityProviderUsers = await trx('identity_provider_user')
-        .withSchema('v1')
-        .whereRaw('user_id = ANY (?)', [whereInUserIds]);
-
-      if (identityProviderUsers.length > 0) {
-        await knex.batchInsert('identity_provider_user', identityProviderUsers).transacting(trx);
-      }
-
       const sessions = await trx('session')
         .withSchema('v1')
         .whereRaw('user_id = ANY (?)', [whereInUserIds]);