🐛 fix: use oauth2.link for generic OIDC provider account linking (#12024)

src/app/[variants]/(main)/settings/profile/features/SSOProvidersList/index.tsx

@@ -6,6 +6,7 @@ import { useTranslation } from 'react-i18next';
 
 import { modal, notification } from '@/components/AntdStaticMethods';
 import AuthIcons from '@/components/AuthIcons';
+import { isBuiltinProvider, normalizeProviderId } from '@/libs/better-auth/utils/client';
 import { useServerConfigStore } from '@/store/serverConfig';
 import { serverConfigSelectors } from '@/store/serverConfig/selectors';
 import { useUserStore } from '@/store/user';
@@ -33,8 +34,11 @@ export const SSOProvidersList = memo(() => {
   }, [providers]);
 
   // Get available providers for linking (filter out already linked)
+  // Normalize provider IDs when comparing to handle aliases (e.g. microsoft-entra-id → microsoft)
   const availableProviders = useMemo(() => {
-    return (oAuthSSOProviders || []).filter((provider) => !linkedProviderIds.has(provider));
+    return (oAuthSSOProviders || []).filter(
+      (provider) => !linkedProviderIds.has(normalizeProviderId(provider)),
+    );
   }, [oAuthSSOProviders, linkedProviderIds]);
 
   const handleUnlinkSSO = async (provider: string) => {
@@ -63,14 +67,24 @@ export const SSOProvidersList = memo(() => {
   };
 
   const handleLinkSSO = async (provider: string) => {
-    if (enableAuthActions) {
-      // Use better-auth native linkSocial API
-      const { linkSocial } = await import('@/libs/better-auth/auth-client');
+    if (!enableAuthActions) return;
+
+    const normalizedProvider = normalizeProviderId(provider);
+    const { linkSocial, oauth2 } = await import('@/libs/better-auth/auth-client');
+
+    if (isBuiltinProvider(normalizedProvider)) {
+      // Use better-auth native linkSocial API for built-in providers
       await linkSocial({
         callbackURL: '/profile',
-        provider: provider as any,
+        provider: normalizedProvider as any,
       });
+      return;
     }
+
+    await oauth2.link({
+      callbackURL: '/profile',
+      providerId: normalizedProvider,
+    });
   };
 
   // Dropdown menu items for linking new providers

src/libs/better-auth/auth-client.ts

@@ -10,6 +10,7 @@ import type { auth } from '@/auth';
 
 export const {
   linkSocial,
+  oauth2,
   accountInfo,
   listAccounts,
   requestPasswordReset,