From 148a3aa271535f664d6263a87f9433a71d1b0daa Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 6 Sep 2026 16:20:17 +0100
Subject: [PATCH] postit: harden oidc settings defaults on startup

---
 .../PostIt/ViewModels/Settings/Settings.cs    | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/PostIt/PostIt/ViewModels/Settings/Settings.cs b/src/PostIt/PostIt/ViewModels/Settings/Settings.cs
index b59ef9933..9547fb4f3 100644
--- a/src/PostIt/PostIt/ViewModels/Settings/Settings.cs
+++ b/src/PostIt/PostIt/ViewModels/Settings/Settings.cs
@@ -123,6 +123,8 @@ public partial class Settings : ViewModelBase
         // build options from a torn read.
         lock (_mutationGate)
         {
+            EnsureAuthenticationDefaultsLocked();
+
             var options = new OidcClientOptions
             {
                 Authority = Authentication.Authority,
@@ -151,6 +153,25 @@ public partial class Settings : ViewModelBase
         }
     }
 
+    private void EnsureAuthenticationDefaultsLocked()
+    {
+        Authentication ??= new AuthenticationSettings();
+
+        if (string.IsNullOrWhiteSpace(Authentication.Authority))
+            Authentication.Authority = AuthenticationSettings.DefaultAuthority;
+
+        if (string.IsNullOrWhiteSpace(Authentication.ClientId))
+            Authentication.ClientId = AuthenticationSettings.DefaultClientId;
+
+        if (string.IsNullOrWhiteSpace(Authentication.RedirectUri))
+            Authentication.RedirectUri = AuthenticationSettings.DesktopRedirectUri;
+
+        if (Authentication.Scopes is null || Authentication.Scopes.Length == 0)
+            Authentication.Scopes = AuthenticationSettings.DefaultScopes;
+
+        Authentication.RefreshScopeListText();
+    }
+
     /// <summary>
     /// Scopes the PostIt client always requires from the OIDC provider,
     /// regardless of what the user has in their settings file.
@@ -334,11 +355,13 @@ public partial class Settings : ViewModelBase
                      AuthenticationSettings.DesktopRedirectUri : settings.Authentication.RedirectUri;
                     if (settings.Authentication.Scopes is null || settings.Authentication.Scopes.Length == 0)
                     {
-                        settings.Authentication.Scopes = AuthenticationSettings.DefaultScopes;
+                        this.Authentication.Scopes = AuthenticationSettings.DefaultScopes;
                     }
                     else
                         this.Authentication.Scopes = settings.Authentication.Scopes;
                 }
+
+                EnsureAuthenticationDefaultsLocked();
             }
             // A disk load (or an embedded-resource fallback) is the
             // baseline, not a user edit. Clear the dirty flag last