From 50c472991a59e41d3b3ffda57696703b6122caa9 Mon Sep 17 00:00:00 2001
From: Jonathan Miller <jmiller-moko@noreply.git.mokoconsulting.tech>
Date: Sat, 6 Jun 2026 18:25:51 -0500
Subject: [PATCH] fix(auth): add login form with OAuth to all error pages

- 403: OAuth buttons moved below password form (matches regular login)
- 404: Login form with OAuth added for unauthenticated users
- Both pages load OAuth2 providers and show Sign In with Google etc.
---
 services/context/context_response.go | 12 ++++++++++++
 templates/status/403.tmpl            |  8 ++++----
 templates/status/404.tmpl            | 21 +++++++++++++++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/services/context/context_response.go b/services/context/context_response.go
index c4b7fd1d1c..68546e0b12 100644
--- a/services/context/context_response.go
+++ b/services/context/context_response.go
@@ -169,6 +169,18 @@ func (ctx *Context) notFoundInternal(logMsg string, logErr error) {
 	ctx.Data["IsRepo"] = ctx.Repo.Repository != nil
 	ctx.Data["Title"] = "Page Not Found"
 	ctx.Data["ErrorMsg"] = "" // FIXME: the template never renders this message, need to fix in the future (and show safe messages to end users)
+	ctx.Data["CurrentURL"] = ctx.Req.URL.RequestURI()
+
+	// Load OAuth2 providers for the login form on error pages
+	if !ctx.IsSigned {
+		oauth2Providers, err := oauth2.GetOAuth2Providers(ctx, optional.Some(true))
+		if err != nil {
+			log.Error("NotFound: GetOAuth2Providers: %v", err)
+		}
+		ctx.Data["OAuth2Providers"] = oauth2Providers
+		ctx.Data["EnableSSPI"] = auth_model.IsSSPIEnabled(ctx)
+	}
+
 	ctx.HTML(http.StatusNotFound, "status/404")
 }
 
diff --git a/templates/status/403.tmpl b/templates/status/403.tmpl
index fdb2146177..9ef55ec26e 100644
--- a/templates/status/403.tmpl
+++ b/templates/status/403.tmpl
@@ -10,10 +10,6 @@
 			</div>
 			{{if not .IsSigned}}
 			<div class="tw-max-w-sm tw-mx-auto tw-mt-4">
-				{{if or .OAuth2Providers .EnableSSPI}}
-					{{template "user/auth/external_auth_methods" .}}
-					<div class="divider"></div>
-				{{end}}
 				<form class="ui form" action="{{AppSubUrl}}/user/login" method="post">
 					{{.CsrfTokenHtml}}
 					<input type="hidden" name="redirect_to" value="{{.CurrentURL}}">
@@ -27,6 +23,10 @@
 					</div>
 					<button class="ui primary fluid button tw-mt-2" type="submit">{{ctx.Locale.Tr "sign_in"}}</button>
 				</form>
+				{{if or .OAuth2Providers .EnableSSPI}}
+					<div class="divider"></div>
+					{{template "user/auth/external_auth_methods" .}}
+				{{end}}
 			</div>
 			{{end}}
 		</div>
diff --git a/templates/status/404.tmpl b/templates/status/404.tmpl
index e83dcf463b..6e5c1aaccf 100644
--- a/templates/status/404.tmpl
+++ b/templates/status/404.tmpl
@@ -11,6 +11,27 @@
 					<a class="tw-block tw-my-4" href="{{.NotFoundGoBackURL}}">{{ctx.Locale.Tr "go_back"}}</a>
 				{{end}}
 			</div>
+			{{if not .IsSigned}}
+			<div class="tw-max-w-sm tw-mx-auto tw-mt-4">
+				<form class="ui form" action="{{AppSubUrl}}/user/login" method="post">
+					{{.CsrfTokenHtml}}
+					<input type="hidden" name="redirect_to" value="{{.CurrentURL}}">
+					<div class="required field">
+						<label>{{ctx.Locale.Tr "home.uname_holder"}}</label>
+						<input type="text" name="user_name" required autofocus>
+					</div>
+					<div class="required field">
+						<label>{{ctx.Locale.Tr "password"}}</label>
+						<input type="password" name="password" required>
+					</div>
+					<button class="ui primary fluid button tw-mt-2" type="submit">{{ctx.Locale.Tr "sign_in"}}</button>
+				</form>
+				{{if or .OAuth2Providers .EnableSSPI}}
+					<div class="divider"></div>
+					{{template "user/auth/external_auth_methods" .}}
+				{{end}}
+			</div>
+			{{end}}
 		</div>
 	</div>
 </div>
-- 
2.52.0