code: keep pam enabled and gate oidc

backend/app.py

@@ -29,10 +29,10 @@ templates = Jinja2Templates(directory="backend/templates")
 
 
 def get_oidc_client(settings: Settings = Depends(get_settings)) -> OIDCClient:
-    if settings.auth_mode != "oidc":
+    if not settings.oidc_enabled:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="OIDC auth not enabled",
+            detail="OIDC not configured",
         )
     try:
         return OIDCClient(settings)
@@ -59,7 +59,8 @@ def whoami(
     current_user: str = Depends(get_current_admin),
     settings: Settings = Depends(get_settings),
 ) -> dict:
-    return {"user": current_user, "auth_mode": settings.auth_mode}
+    auth_mode = "pam+oidc" if settings.oidc_enabled else "pam"
+    return {"user": current_user, "auth_mode": auth_mode}
 
 
 @app.post("/login", response_model=LoginResponse)
@@ -115,7 +116,7 @@ def oidc_callback(
     username = oidc.extract_username(claims)
     if not username:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Missing username claim")
-    if not is_authorized_admin(username, settings):
+    if not is_authorized_admin(username, settings, mode="oidc"):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User not authorized to log in")
 
     token = issue_token(username, settings)
@@ -132,6 +133,11 @@ def oidc_callback(
     return redirect
 
 
+@app.get("/login/oidc/status")
+def oidc_status(settings: Settings = Depends(get_settings)) -> dict:
+    return {"enabled": settings.oidc_enabled}
+
+
 @app.get("/users", response_model=List[UserStatus], dependencies=[Depends(get_current_admin)])
 def users(settings: Settings = Depends(get_settings)) -> List[UserStatus]:
     logged_in = set(actions.list_logged_in_users())