fix(auth): support employee ID usernames

Assisted-by: Codex:GPT-5

routers/web/auth/auth.go

@@ -450,6 +450,11 @@ func extractUserNameFromOAuth2(gothUser *goth.User) (string, error) {
 			return user_model.NormalizeUserName(preferredUsername)
 		}
 		return "", nil
+	case setting.OAuth2UsernameEmployeeID:
+		if employeeID, ok := gothUser.RawData["employee_id"].(string); ok {
+			return user_model.NormalizeUserName(employeeID)
+		}
+		return "", nil
 	case setting.OAuth2UsernameNickname:
 		return user_model.NormalizeUserName(gothUser.NickName)
 	default: // OAuth2UsernameUserid

routers/web/auth/auth_test.go

@@ -184,6 +184,20 @@ func TestWebAuthOAuth2(t *testing.T) {
 	})
 }
 
+func TestExtractUserNameFromOAuth2EmployeeID(t *testing.T) {
+	defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameEmployeeID)()
+
+	username, err := extractUserNameFromOAuth2(&goth.User{
+		RawData: map[string]any{"employee_id": "RC001"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "RC001", username)
+
+	username, err = extractUserNameFromOAuth2(&goth.User{RawData: map[string]any{}})
+	require.NoError(t, err)
+	assert.Empty(t, username)
+}
+
 func TestOpenIDRequireTwoFactor(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	mockOpt := contexttest.MockContextOption{SessionStore: session.NewMockMemStore("dummy-sid-openid")}

routers/web/auth/oauth.go

@@ -160,6 +160,8 @@ func SignInOAuthCallback(ctx *context.Context) {
 					missingFields = append(missingFields, "nickname")
 				case setting.OAuth2UsernamePreferredUsername:
 					missingFields = append(missingFields, "preferred_username")
+				case setting.OAuth2UsernameEmployeeID:
+					missingFields = append(missingFields, "employee_id")
 				} // else: "UserID" and "Email" have been handled above separately
 			}
 			if len(missingFields) > 0 {