feat(sso): add provider detail endpoint DEV-2665

[rajpatel24]

📣 Summary

This PR adds a public API endpoint that resolves an SSO provider's URL identifier into its display name, so the upcoming React login screens can render the "Log in with …" page that Django templates render today.

📖 Description

This PR adds GET /api/v2/social-apps/<provider_id>/, which returns the provider_id and name for a configured Social Application.

Some organizations sign in through an SSO provider that is deliberately not shown on the public login page. Its Social Application has is_public unchecked, and they distribute a direct link to their own staff, for example: https://<kobo-server>/accounts/oidc/nca/login/. Only the nca part varies. Today, that URL renders a shared Django template titled "Log in with {{ SocialApp.name }}". The same template is used for every provider on every server.

The Authentication Redesign deletes that template and rebuilds the screen in the SPA. To render it at a route like #/login/oidc/<provider_id>, the frontend needs to turn provider_id into a display name and distinguish a real provider from a typo so it can show the appropriate 404. The frontend cannot read the database directly, so it needs this endpoint.

Nothing changes for users yet. The existing login pages are untouched.

👀 Preview steps

1. ℹ️ Have a superuser account and be able to run manage.py.
2. Create a hidden SSO provider (provision_server sets is_public=False):

./manage.py provision_server socialapp --provider openid_connect \
  --provider_id nca --name "Norwegian Church Aid" \
  --client_id test-client-id --secret test-secret

3. Log out and open /accounts/login/.

4. ℹ️ Notice that "Norwegian Church Aid" is not among the SSO buttons because the provider is hidden.

5. Open /accounts/oidc/nca/login/.

6. ℹ️ Notice that the "Log in with Norwegian Church Aid" page still renders unchanged.

7. 🔴 On main: GET /api/v2/social-apps/nca/ -> 404, because the route does not exist.

8. 🟢 On the PR: GET /api/v2/social-apps/nca/ -> 200 {"provider_id": "nca", "name": "Norwegian Church Aid"} even though the provider is hidden. That's the point of the endpoint.

9. 🟢 GET /api/v2/social-apps/typo/ -> 404.

10. 🟢 GET /api/v2/social-apps/ -> 404. There is deliberately no list endpoint.

11. 🟢 Notice that the response has exactly two keys. It does not expose client_id, secret, or server_url.

[greptile-apps]

Greptile Summary

The PR adds an anonymous API endpoint that resolves an SSO provider identifier to display-only provider data for the upcoming SPA login flow.

• Adds explicit provider-detail routing, lookup behavior, serialization, and tests for public, hidden, unknown, ambiguous, fallback, and dotted provider identifiers.
• Publishes the endpoint in both OpenAPI formats and regenerates the TypeScript model, React Query helper, and mock handler.
• Keeps provider credentials and internal settings out of the response and intentionally provides no list endpoint.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the eligible follow-up review scope.

No blocking failure remains.

Sequence Diagram

sequenceDiagram
    participant SPA as React login screen
    participant API as SocialAppView
    participant Adapter as allauth adapter
    participant DB as SocialApp storage
    SPA->>API: "GET /api/v2/social-apps/{provider_id}/"
    API->>Adapter: get_app(request, provider_id)
    Adapter->>DB: Resolve configured provider
    alt Exactly one provider
        DB-->>Adapter: SocialApp
        Adapter-->>API: SocialApp
        API-->>SPA: "200 {provider_id, name}"
    else Missing or ambiguous
        API-->>SPA: 404 Not found
    end

Loading

_{Reviews (4): Last reviewed commit: "style: fix linting issues" | Re-trigger Greptile}

[noliveleger]

You should call self.check_object_permissions(self.request, obj) even if it would do nothing special. Just as a safety guard if the permission classes is changed some day.
Or at least , leave a comment why you omitted. permission_classes is useless atm.

[noliveleger]

You can probably set it at the View level. No need to overload the parent for nothing. I think we do have some examples in the code.