[NicolasRoelofs]

Summary

Fixes an issue in Generic OAuth/OIDC authentication where an already linked identity may result in the creation of a duplicate CWA user during a subsequent login.

The existing OAuth association should take precedence over username/email matching when resolving the local CWA account.

Problem

When an existing CWA account is explicitly linked to an OIDC identity, the initial linking operation can succeed.

However, on a subsequent OAuth login, the application may search for a local user using the configured username or email claims before considering the existing OAuth association.

If the identity provider returns an opaque sub value as the username and no matching email is available, CWA may create a new user instead of reusing the previously linked account.

This can lead to:

• Duplicate local user accounts.
• Loss of access to the existing account's permissions and preferences during OAuth login.
• An existing OAuth binding being reassigned to the newly created account.

Proposed fix

During a normal OAuth login:

1. Look up the existing OAuth identity binding using the provider ID and provider_user_id.
2. If the binding points to an existing CWA user, reuse that user.
3. Preserve the explicit account-linking flow.
4. Keep the existing username/email matching and user-creation behavior for identities without an existing binding.
5. Preserve existing authorization and group-based role checks.

No database schema changes are required.

Reproduction

Environment: Calibre-Web Automated v4.0.8, Generic OIDC provider.

Example configuration:

• CWA username: reader
• CWA email: reader@example.com
• OIDC subject (sub): opaque-sub-123
• Username field: sub
• Email field: email

Steps:

1. Create an existing local CWA account.
2. Link it explicitly to an OIDC identity.
3. Confirm that the link is stored.
4. Sign out of CWA.
5. Sign in using Generic OAuth with the same OIDC identity.

Actual behavior before the fix: A new user may be created from the opaque subject despite the existing OAuth association.

Expected behavior: The previously linked CWA account is reused, with its original permissions and preferences.

Validation

The fix was manually validated in a CWA v4.0.8 Docker deployment:

• Existing local account was linked to a Generic OIDC identity.
• Subsequent SSO logins reused the associated account.
• No duplicate account was created.
• Existing administrator permissions were preserved.

Automated regression tests and review against the current development branch are still needed.

Scope

This PR focuses exclusively on OAuth identity resolution and account linking.

It does not introduce automatic SSO redirects, change OAuth provider configuration, or modify the database schema.