[compscidr]

Closes #668.

A Login methods section at the bottom of Admin → Settings:

• GitHub: on/off, the Authorization callback URL for this site (<origin>/login), and Client ID / Client Secret fields. Saving calls PUT /api/v1/login-methods/github (admin only), which replaces client_id/client_secret in .env (other lines kept) and sets them in the environment, so the login page offers GitHub without a restart. Values must be [A-Za-z0-9._-]+, so nothing can add a line to .env.
• Email: whether SMTP is configured; still set in .env + restart.

Once GitHub is configured, a Sign in with GitHub as admin button runs the GitHub flow with ?admin=1. When GitHub returns, the callback makes that GitHub account an admin, but only if the browser is still signed in as an admin at that point. The admin then stays signed in with GitHub, and their password login keeps working. Without this, signing in with GitHub on a site that already has an admin creates a separate account that isn't an admin.

Not done: removing GitHub login from the UI, and editing SMTP from the UI.

Test plan

• go test ./... — new TestSaveGithubLogin covers non-admin 401, empty/newline values 400, .env rewrite and env update
• New TestGithubCallback_AdminPromotesTheirGithubAccount: promoted when the browser is signed in as an admin, not when it's signed out (fails without the change)
• Manually: on a password-only install, save an OAuth app in Settings, then use "Sign in with GitHub as admin" and check the GitHub account is an admin

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

It handles OAuth credentials by rewriting .env on disk and mutating the running process environment, a security-sensitive operation that warrants final human review despite no defects being found.

No open issues 🎉

What changed in this PR

This PR adds a Login methods section to Admin → Settings so an admin can enable GitHub login on a password-only install without hand-editing .env and restarting (closes #668). It introduces an admin-only PUT /api/v1/login-methods/github endpoint that validates the submitted Client ID/Secret, rewrites .env (preserving other lines), and updates the process environment so /login and the OAuth flow pick up the new credentials immediately. It also surfaces whether email (SMTP) login is configured for informational purposes.

Changes:

• New admin/login_methods.go handler (SaveGithubLogin + setGithubEnv) with strict ^[A-Za-z0-9._-]+$ credential validation to prevent .env injection, plus a focused test.
• AdminSettings now loads .env and passes github_client_id, github_callback_url, and email_login_enabled to the template; a new Settings UI section and saveGithubLogin() JS call the endpoint.
• Registers the new route in goblog.go.

File	Description
admin/​login_methods.go	New admin-only handler and .env rewrite helper that validates and persists GitHub OAuth credentials.
admin/​login_methods_test.go	Tests non-admin 401, empty/newline-value 400, .env rewrite correctness, and env update.
admin/​admin.go	Loads .env and supplies Login-methods template data (client id, callback URL, email status).
goblog.go	Registers PUT /api/v1/login-methods/github.
themes/​default/​templates/​admin_settings.html	Adds the Login methods section (GitHub form + email status) outside the settings form.
www/​js/​admin-script.js	Adds saveGithubLogin() to submit credentials and reload on success.

Notes from verification: the endpoint is covered by the global requireJSON() + SameSite=Lax CSRF defenses, the admin check matches the codebase's StatusUnauthorized, "Not Authorized" convention, the GitHub form inputs are correctly placed outside #settings-form (so they aren't sent by updateSettings), the /admin/users link resolves to a real route, and os.Setenv/os.Getenv are lock-guarded so the runtime update is race-free. Only the default theme ships admin_settings.html, so there is no cross-theme gap.

_{Review effort: Balanced}