Repository: go-gitea/gitea
File: services/auth/source/oauth2/providers.go (Go)

Code before:
		return false
	}

	for _, source := range authSources {
		if oauth2Cfg, ok := source.Cfg.(*Source); ok {
			if isAzureProvider(oauth2Cfg.Provider) {
				return true
			}
		}
	}
	return false
}

// GetSupportedOAuth2Providers returns the map of unconfigured OAuth2 providers
// key is used as technical name (like in the callbackURL)
// values to display
// Note: Azure AD providers (azuread, microsoftonline, azureadv2) are filtered out
// unless they already exist in the system to encourage use of OpenID Connect
func GetSupportedOAuth2Providers() []Provider {
	return GetSupportedOAuth2ProvidersWithContext(context.Background())
}

// GetSupportedOAuth2ProvidersWithContext returns the list of supported OAuth2 providers with context for filtering
func GetSupportedOAuth2ProvidersWithContext(ctx context.Context) []Provider {
	providers := make([]Provider, 0, len(gothProviders))
	hasExistingAzure := hasExistingAzureADAuthSources(ctx)

	for _, provider := range gothProviders {
		if isAzureProvider(provider.Name()) && !hasExistingAzure {
			continue
		}
		providers = append(providers, provider)
	}
	sort.Slice(providers, func(i, j int) bool {
		return providers[i].Name() < providers[j].Name()
	})
	return providers
}

func CreateProviderFromSource(source *auth.Source) (Provider, error) {
	oauth2Cfg, ok := source.Cfg.(*Source)
	if !ok {
		return nil, fmt.Errorf("invalid OAuth2 source config: %v", oauth2Cfg)
	}
	gothProv := gothProviders[oauth2Cfg.Provider]
	return &AuthSourceProvider{GothProvider: gothProv, sourceName: source.Name, iconURL: oauth2Cfg.IconURL}, nil
}

// GetOAuth2Providers returns the list of configured OAuth2 providers
func GetOAuth2Providers(ctx context.Context, isActive optional.Option[bool]) ([]Provider, error) {
	authSources, err := db.Find[auth.Source](ctx, auth.FindSourcesOptions{

Review comment (security):
I mean
```go
existAuthSources := getExistingAzureADAuthSources(ctx)
for _, provider := range gothProviders {
		if isAzureProvider(provider.Name()) && !slices.Contains(existAuthSources, provider.Name()) {
			continue
		}

Code after:
			if isAzureProvider(oauth2Cfg.Provider) {
				existingAzureProviders = append(existingAzureProviders, oauth2Cfg.Provider)
			}
		}
	}
	return existingAzureProviders, nil
}

// GetSupportedOAuth2Providers returns the map of unconfigured OAuth2 providers
// key is used as technical name (like in the callbackURL)
// values to display
// Note: Azure AD providers (azuread, microsoftonline, azureadv2) are filtered out
// unless they already exist in the system to encourage use of OpenID Connect
func GetSupportedOAuth2Providers() []Provider {
	return GetSupportedOAuth2ProvidersWithContext(context.Background())
}

// GetSupportedOAuth2ProvidersWithContext returns the list of supported OAuth2 providers with context for filtering
func GetSupportedOAuth2ProvidersWithContext(ctx context.Context) []Provider {
	providers := make([]Provider, 0, len(gothProviders))
	existingAzureSources, err := getExistingAzureADAuthSources(ctx)
	if err != nil {
		log.Error("Failed to get existing OAuth2 auth sources: %v", err)
	}

	for _, provider := range gothProviders {
		if isAzureProvider(provider.Name()) && !slices.Contains(existingAzureSources, provider.Name()) {
			continue
		}
		providers = append(providers, provider)
	}
	sort.Slice(providers, func(i, j int) bool {
		return providers[i].Name() < providers[j].Name()
	})
	return providers
}

func CreateProviderFromSource(source *auth.Source) (Provider, error) {
	oauth2Cfg, ok := source.Cfg.(*Source)
	if !ok {
		return nil, fmt.Errorf("invalid OAuth2 source config: %v", oauth2Cfg)
	}
	gothProv := gothProviders[oauth2Cfg.Provider]
	return &AuthSourceProvider{GothProvider: gothProv, sourceName: source.Name, iconURL: oauth2Cfg.IconURL}, nil
}

// GetOAuth2Providers returns the list of configured OAuth2 providers
func GetOAuth2Providers(ctx context.Context, isActive optional.Option[bool]) ([]Provider, error) {
	authSources, err := db.Find[auth.Source](ctx, auth.FindSourcesOptions{
		IsActive:  isActive,
		LoginType: auth.OAuth2,