users: OAuth sign-in provisions new accounts even when allow_signup is off #543

allow_signup (default False) gates only local registration (auth_local/api.py / auth_local/views.py). The OAuth callback (modules/users/users/oauth/api.py, user_manager.oauth_callback(..., associate_by_email=True, is_verified_by_default=True)) creates a verified account for any holder of an account at a configured provider, regardless of allow_signup.

An operator who enables Google/GitHub SSO for staff and leaves signups off still has an open signup for the whole provider's user base. Before #525 those accounts held no role. #525 now attaches the user role to them only when allow_signup is on, but the accounts themselves are still created.

Fix direction: refuse to create a new account from OAuth unless allow_signup is on (or add an explicit oauth_auto_provision / allowed-domains setting), while still letting existing accounts link and sign in. Add tests for both modes.

Found in the security review of #525.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4