[Bug]: Generic OIDC "Scope" field is ignored, so Google login fails with invalid_scope (offline_access) #198

DBackup Version

v4.0.2

Installation Method

Docker (docker-compose)

Bug Description

When using the Generic OIDC adapter with Google as the identity provider, sign-in fails at Google with:

Error 400: invalid_scope - Some requested scopes were invalid.
{valid=[openid, .../auth/userinfo.email, .../auth/userinfo.profile], invalid=[offline_access]}

The Scope field in the provider form is set to "openid profile email", but dbackup still requests offline_access, which Google does not accept.

From reading the code, OidcProviderService stores the form value in oidcConfig as scope (a single string). better-auth's SSO plugin reads scopes (an array), so the configured value appears to be ignored and better-auth's default scopes (including offline_access) are used. Also, updateProvider resets scope to "openid profile email" whenever the config is rebuilt.

Workaround that fixed it for me: stopping the container and adding the scopes key directly to the oidcConfig JSON in the SQLite DB:
json_set(oidcConfig, '$.scopes', json('["openid","email","profile"]'))
After that, Google login worked.

Suggested fix: write the configured scopes to scopes as an array (split the string on whitespace) in oidcConfig, and make sure updateProvider keeps the existing value.

Steps to Reproduce

1. Create a Google Cloud OAuth client (Web application) with redirect URI https:///api/auth/sso/callback/generic
2. In dbackup, go to Settings > SSO Providers > Add Provider > Generic
3. Enter issuer https://accounts.google.com, the Google authorization, token and userinfo endpoints, the client ID and secret, and scope "openid profile email"
4. Set TRUSTED_ORIGINS to include the Google endpoint origins (needed first, otherwise dbackup rejects the token endpoint)
5. Click "Sign in with Google" on the login page
6. Google shows "Access blocked: Authorisation error ... Error 400: invalid_scope"

Expected Behavior

Only the scopes configured on the provider (openid profile email) are requested, so Google sign-in works with the Generic adapter.

Logs / Error Output

Access blocked: Authorisation error
Some requested scopes were invalid. {valid=[openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile], invalid=[offline_access]}
Error 400: invalid_scope

Screenshots

No response

Environment

• OS: MacOS
• Docker: Docker version 29.8.2, build 7fc2dff
• Identity provider: Google (Generic OIDC adapter)
• Browser: Chrome