feat(auth): add support for enabling/disabling socialite providers

[roble]

This pull request introduces a comprehensive system for configuring which social login providers ("Socialite providers") are available to users through the admin interface. It ensures that only enabled providers are shown on the login page and that authentication routes are protected from disabled or unknown providers. The implementation includes backend settings, middleware enforcement, UI updates, and thorough testing.

Administrative control over social login providers:

• Adds a new enabled_socialite_providers setting to AuthSettings, with a migration and admin UI allowing selection of which providers are enabled. [1] [2] [3] [4]
• Updates SocialiteService to provide only enabled providers and to validate provider availability, including methods for checking and listing enabled providers.

Middleware and route protection:

• Introduces EnsureSocialiteProviderEnabled middleware to block access to socialite routes for disabled or unknown providers, returning a 404 error if accessed. This middleware is applied to relevant routes. [1] [2] [3]

Frontend and user experience:

• Updates React and Vue components to dynamically display only enabled socialite providers, using labels and icons, and to support testability with new data attributes. [1] [2] [3]

Inertia data sharing:

• Shares the list of enabled socialite providers with frontend pages via Inertia, ensuring the UI always reflects current settings. [1] [2]

Testing and validation:

• Adds and updates tests to cover the new settings, UI, and middleware, including tests for enabling/disabling providers, handling unknown providers, and ensuring routes are protected. [1] [2] [3] [4] [5] [6]

Summary by CodeRabbit

• New Features

  • Added Social Login settings to enable or disable available providers.
  • Login and registration pages now display only enabled providers with configured labels and icons.
  • Social login redirects and callbacks reject disabled or unavailable providers.
  • Added safer handling when provider configuration is missing or invalid.

• Bug Fixes

  • Prevented unsupported providers from appearing or being used in social login flows.
  • Updated social login account linking to honor provider availability settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ed961892-b288-4de0-8bed-f6d63eaf1547

📥 Commits

Reviewing files that changed from the base of the PR and between 5b2fc01 and 4eff246.

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing (19)

• composer.json
• database/settings/2026_08_29_153753_add_enabled_socialite_providers_to_auth_settings.php
• resources/js/react/components/SocialiteProviders.tsx
• resources/js/types/page-props.d.ts
• resources/js/vue/components/SocialiteProviders.vue
• routes/web.php
• src/Filament/Pages/AuthenticationSettings.php
• src/Http/Middleware/EnsureSocialiteProviderEnabled.php
• src/Providers/AuthServiceProvider.php
• src/Services/SocialiteService.php
• src/Settings/AuthSettings.php
• tests/Feature/AuthSettingsTest.php
• tests/Feature/AuthenticationSettingsPageTest.php
• tests/Feature/LoginTest.php
• tests/Feature/SocialiteAvailabilityTest.php
• tests/Feature/SocialiteCallbackTest.php
• tests/Feature/SocialiteDisconnectTest.php
• tests/Unit/SocialiteServiceTest.php
• tests/e2e/tests/login/login.social.spec.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds configurable Socialite providers. Authentication settings persist enabled providers, backend services filter and validate them, OAuth routes enforce availability, and React/Vue components render the shared provider configuration.

Changes

Socialite provider configuration

Layer / File(s)	Summary
Settings and administrator controls database/settings/*, src/Settings/AuthSettings.php, src/Filament/Pages/AuthenticationSettings.php, tests/Feature/AuthSettingsTest.php, tests/Feature/AuthenticationSettingsPageTest.php	Authentication settings now store enabled Socialite providers. The settings page lists configured providers, validates selections, and supports clearing all providers.
Provider filtering and OAuth enforcement composer.json, src/Services/SocialiteService.php, src/Http/Middleware/EnsureSocialiteProviderEnabled.php, src/Providers/AuthServiceProvider.php, routes/web.php, tests/Feature/Socialite*, tests/Unit/SocialiteServiceTest.php	SocialiteService normalizes and filters providers. The middleware blocks disabled or unknown providers on redirect and callback routes. Shared Inertia data contains enabled providers.
Frontend provider rendering and end-to-end coverage resources/js/react/components/SocialiteProviders.tsx, resources/js/vue/components/SocialiteProviders.vue, resources/js/types/page-props.d.ts, tests/Feature/LoginTest.php, tests/e2e/tests/login/login.social.spec.ts	React and Vue components render configured labels and optional icons. Tests cover provider visibility on login and registration pages.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 4eff2

This change adds configurable social login providers and protects disabled or unknown provider routes; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant Admin
  participant AuthenticationSettings
  participant AuthSettings
  participant SocialiteService
  participant LoginPage
  participant OAuthRoute
  participant EnsureSocialiteProviderEnabled

  Admin->>AuthenticationSettings: Save enabled providers
  AuthenticationSettings->>AuthSettings: Persist provider names
  LoginPage->>SocialiteService: Request enabled providers
  SocialiteService->>AuthSettings: Read provider settings
  SocialiteService-->>LoginPage: Return provider names and labels
  LoginPage->>OAuthRoute: Start provider authentication
  OAuthRoute->>EnsureSocialiteProviderEnabled: Check route provider
  EnsureSocialiteProviderEnabled->>SocialiteService: Validate provider is enabled

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.93% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 17 files. (2 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding support to enable or disable Socialite providers through authentication settings.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 20.93% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 17 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-improvements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}