Description

Implements OAuth-only self-registration feature as requested in #8042.

What this PR does:

1. New setting ‘OAuth Registration Allowed’ in Settings > Advanced

   • When enabled, allows users to self-register via OAuth even when general registration is disabled
   • Users registered this way are marked as oauth_only

2. OAuth-only users have restrictions:

   • Cannot login with password (must use OAuth)
   • Cannot reset password
   • Must continue using the OAuth provider they registered with

3. Database changes:

   • Added is_oauth_registration_enabled boolean to instance_settings table
   • Added oauth_only boolean flag to users table

4. UI updates:

   • Login page shows helpful message when OAuth registration is enabled but general registration is disabled
   • New checkbox in Settings > Advanced for enabling OAuth Registration

Use Case

This allows organizations to:

• Control who can access Coolify through identity providers like Authentik
• Disable general email/password registration while still allowing OAuth self-registration
• Suspend access across multiple Coolify instances by deactivating users in the identity provider
• Prevent OAuth users from creating passwords (ensuring single point of access control)

How to test

1. Run migrations to add the new database columns
2. Go to Settings > Advanced
3. Disable ‘Registration Allowed’ and enable ‘OAuth Registration Allowed’
4. Configure an OAuth provider in Settings > OAuth
5. Log out and verify:
   • Regular registration is disabled
   • Login page shows OAuth providers with ‘New users can register via OAuth’ message
   • New users can register via OAuth and are marked as oauth_only
   • These users cannot reset password or login with email/password

Related Issues

Closes #8042

/claim #8042