Hyeonsang Cho 0479934fe2
fix(auth): read the live config off the event loop on public auth routes (#7576)
* fix(auth): read the live config off the event loop on public auth routes

/register, /setup-status, /providers, /oauth/{provider} and
/callback/{provider} read the live auth config through get_app_config()
inline. That call stats and hashes config.yaml and extensions_config.json
on every request and reparses them after an edit, and these routes are
unauthenticated, so any client could keep that file IO on the event
loop. /login/local already reads its throttle policy in a worker.

Read the registration gate through asyncio.to_thread, and the SSO
routes' auth.oidc section through a shared _oidc_config() helper that
does the same.

* docs(changelog): reference #7576 for the off-loop auth route config reads

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-26 22:11:48 +08:00
..