From eee372bb3cd723060df412f701a6615dd3892939 Mon Sep 17 00:00:00 2001
From: Vlad Stan <stan.v.vlad@gmail.com>
Date: Wed, 22 Jul 2026 11:54:23 +0300
Subject: [PATCH] fix: sso missing user id (#4082)

---
 lnbits/core/views/auth_api.py |  2 +-
 tests/api/test_auth_api.py    | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lnbits/core/views/auth_api.py b/lnbits/core/views/auth_api.py
index 5d5c08d4f..5a88c257f 100644
--- a/lnbits/core/views/auth_api.py
+++ b/lnbits/core/views/auth_api.py
@@ -326,7 +326,7 @@ async def api_delete_user_api_token(
 async def login_with_sso_provider(
     request: Request,
     provider: str,
-    user_id: str | None,
+    user_id: str | None = None,
     auth_user_id: str | None = Depends(optional_user_id),
 ):
     provider_sso = _new_sso(provider)
diff --git a/tests/api/test_auth_api.py b/tests/api/test_auth_api.py
index 8993cd8a9..83ea8dc55 100644
--- a/tests/api/test_auth_api.py
+++ b/tests/api/test_auth_api.py
@@ -58,6 +58,24 @@ async def test_auth_api_logout_and_update_ui_customization(
     assert "cookie_access_token=" in logout.headers["set-cookie"]
 
 
+@pytest.mark.anyio
+async def test_auth_api_keycloak_login_without_user_id_redirects_to_provider(
+    http_client: AsyncClient, mocker
+):
+    provider = "keycloak"
+    login_sso = _FakeSSO()
+    mocker.patch("lnbits.core.views.auth_api._new_sso", return_value=login_sso)
+
+    response = await http_client.get(f"/api/v1/auth/{provider}")
+
+    assert response.status_code == 307
+    assert response.headers["location"] == "https://example.com/sso/login"
+    assert login_sso.redirect_uri == (
+        f"{http_client.base_url}/api/v1/auth/{provider}/token"
+    )
+    assert login_sso.state is None
+
+
 @pytest.mark.anyio
 async def test_auth_api_sso_login_and_callback(http_client: AsyncClient, mocker):
     user = await create_user_account(