fix(auth): support employee ID usernames

Assisted-by: Codex:GPT-5

modules/setting/oauth2.go

@@ -20,11 +20,12 @@ const (
 	OAuth2UsernameNickname          OAuth2UsernameType = "nickname"           // use nickname field
 	OAuth2UsernameEmail             OAuth2UsernameType = "email"              // use email field
 	OAuth2UsernamePreferredUsername OAuth2UsernameType = "preferred_username" // use preferred_username field
+	OAuth2UsernameEmployeeID        OAuth2UsernameType = "employee_id"        // use employee_id field
 )
 
 func (username OAuth2UsernameType) isValid() bool {
 	switch username {
-	case OAuth2UsernameUserid, OAuth2UsernameNickname, OAuth2UsernameEmail, OAuth2UsernamePreferredUsername:
+	case OAuth2UsernameUserid, OAuth2UsernameNickname, OAuth2UsernameEmail, OAuth2UsernamePreferredUsername, OAuth2UsernameEmployeeID:
 		return true
 	}
 	return false

modules/setting/oauth2_test.go

@@ -88,3 +88,11 @@ ENABLE_OPENID_CONNECT_PKCE = true
 	loadOAuth2ClientFrom(cfg)
 	assert.True(t, OAuth2Client.EnableOpenIDConnectPKCE)
 }
+
+func TestOAuth2ClientEmployeeIDUsername(t *testing.T) {
+	cfg, _ := NewConfigProviderFromData(`[oauth2_client]
+USERNAME = employee_id
+`)
+	loadOAuth2ClientFrom(cfg)
+	assert.Equal(t, OAuth2UsernameEmployeeID, OAuth2Client.Username)
+}