{"record":{"id":"84f20bc569be7492","repo":"wg-easy/wg-easy","slug":"provider-is-not-enabled","errorCode":null,"errorMessage":"Provider is not enabled","messagePattern":"Provider is not enabled","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"src/server/utils/oauth.ts","lineNumber":103,"sourceCode":"    return;\n  }\n\n  // WG_ENV.OAUTH_PROVIDERS is filtered to configured providers during startup.\n  return OAUTH_PROVIDERS[provider] as ConfiguredOAuthConfig;\n}\n\nexport async function buildOauthConfig(event: H3Event) {\n  const provider = getRouterParam(event, 'provider');\n  if (!provider || !isValidOauthProvider(provider)) {\n    throw createError({\n      statusCode: 400,\n      statusMessage: 'Invalid provider',\n    });\n  }\n\n  const oauthProvider = getEnabledOauthProvider(provider);\n  if (!oauthProvider) {\n    throw createError({\n      statusCode: 403,\n      statusMessage: 'Provider is not enabled',\n    });\n  }\n\n  const config = await client.discovery(\n    new URL(oauthProvider.server),\n    oauthProvider.clientId,\n    {\n      client_secret: oauthProvider.clientSecret,\n    }\n  );\n\n  return { config, providerConfig: oauthProvider, provider };\n}\n\nexport async function githubUserInfoFlow(accessToken: string) {\n  const OAUTH_GITHUB_FLOW = {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/wg-easy/wg-easy/blob/5c38c1427a0c6c62f1bbc6724233a71d931ac431/src/server/utils/oauth.ts#L85-L121","documentation":"Thrown when the provider name is valid but no enabled OAuth provider configuration exists for it (getEnabledOauthProvider returns null). HTTP 403 — the provider is known but disabled by the administrator.","triggerScenarios":"Attempting to log in via a provider that exists in the code but was never configured/enabled in settings; admin disabled the provider while users still have old login links.","commonSituations":"Fresh deployment where OAuth providers haven't been enabled yet, provider toggled off in admin settings, users bookmarking disabled sign-in buttons.","solutions":["Enable and configure the provider in the admin OAuth settings","Remove or hide login buttons/links for disabled providers in the frontend","Use a different, enabled provider for sign-in","Verify the provider's stored config (client id/secret, enabled flag) is saved, not just drafted"],"exampleFix":"// before\nawait $fetch('/auth/oauth/github'); // github not enabled\n// after — admin enables github in settings first\nawait $fetch('/admin/oauth/github', { method: 'PUT', body: { enabled: true, clientId, clientSecret } });\nawait $fetch('/auth/oauth/github');","handlingStrategy":"validation","validationCode":"const providers = await $fetch('/admin/oauth');\nif (!providers.find(p => p.name === provider && p.enabled)) throw new Error(`${provider} is not enabled`);","typeGuard":"function isProviderEnabled(p) { return p?.enabled === true && !!p?.clientId; }","tryCatchPattern":"try {\n  await startOauth(provider);\n} catch (e) {\n  if (e.statusCode === 403 && e.statusMessage === 'Provider is not enabled') {\n    // surface a friendly message: ask admin to enable the provider\n  }\n  throw e;\n}","preventionTips":["Only render sign-in buttons for enabled providers (query enabled list)","Configure and save the provider fully (clientId/secret + enabled flag) in admin settings","Communicate provider disablements to users; clean up stale links"],"tags":["oauth","http-403","configuration"],"backgroundTag":"oauth-provider-disabled","analyzedSha":"5c38c1427a0c6c62f1bbc6724233a71d931ac431","analyzedAt":"2026-08-30T04:35:56.098Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}