fix: Disabling of authorization providers with env (#12349)

* fix: Disabling of authorization providers with env

* fix: type error in authenticationProviders delete test

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

server/routes/api/authenticationProviders/authenticationProviders.test.ts

@@ -1,4 +1,7 @@
 import { randomUUID } from "node:crypto";
+import sharedEnv from "@shared/env";
+import env from "@server/env";
+import { AuthenticationProvider } from "@server/models";
 import { buildUser, buildAdmin, buildTeam } from "@server/test/factories";
 import { getTestServer, setSelfHosted } from "@server/test/support";
 
@@ -6,6 +9,10 @@ const server = getTestServer();
 
 beforeEach(setSelfHosted);
 
+function setCloudHosted() {
+  env.URL = sharedEnv.URL = "https://app.getoutline.com";
+}
+
 describe("#authenticationProviders.info", () => {
   it("should return auth provider", async () => {
     const team = await buildTeam();
@@ -154,7 +161,28 @@ describe("#authenticationProviders.list", () => {
 });
 
 describe("#authenticationProviders.delete", () => {
-  it("should allow admins to delete authentication provider", async () => {
+  it("should disable the provider on self-hosted and keep the row", async () => {
+    const team = await buildTeam();
+    const user = await buildAdmin({
+      teamId: team.id,
+    });
+    const googleProvider = await team.$create("authenticationProvider", {
+      name: "google",
+      providerId: randomUUID(),
+    });
+    const res = await server.post("/api/authenticationProviders.delete", {
+      body: {
+        id: googleProvider.id,
+        token: user.getJwtToken(),
+      },
+    });
+    expect(res.status).toEqual(200);
+    const reloaded = await AuthenticationProvider.findByPk(googleProvider.id);
+    expect(reloaded?.enabled).toBe(false);
+  });
+
+  it("should destroy the provider on cloud hosted", async () => {
+    setCloudHosted();
     const team = await buildTeam();
     const user = await buildAdmin({
       teamId: team.id,

server/routes/api/authenticationProviders/authenticationProviders.ts

@@ -1,5 +1,6 @@
 import Router from "koa-router";
 import { UserRole } from "@shared/types";
+import env from "@server/env";
 import auth from "@server/middlewares/authentication";
 import { transaction } from "@server/middlewares/transaction";
 import validate from "@server/middlewares/validate";
@@ -98,7 +99,13 @@ router.post(
       await authenticationProvider.disable(ctx);
     }
 
-    await authenticationProvider.destroy({ transaction });
+    // On self-hosted, providers are typically registered via env vars and
+    // would re-appear on the login screen if the row was destroyed, so we
+    // keep the row with enabled=false. On cloud, destroy the row so the
+    // admin can reconnect with a different workspace.
+    if (env.isCloudHosted) {
+      await authenticationProvider.destroy({ transaction });
+    }
 
     ctx.body = {
       success: true,