From 3282ba8eab47a20b8be9b519e2e5cd99c5685f36 Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Wed, 1 Jul 2026 15:17:10 -0400
Subject: [PATCH] fix: Miscellaneous fixes

---
 src/core/config/mod.rs         |  5 ++++-
 src/service/oidc/mod.rs        | 22 ++++++++++------------
 src/service/users/remote.rs    |  2 +-
 src/web/pages/account/login.rs |  4 ----
 4 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index f993b0adb..5f67e4623 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -2509,6 +2509,9 @@ pub struct OidcConfig {
 	/// and possibly on subsequent logins as well, depending on the value of
 	/// `profile_key_import_mode` (see below).
 	///
+	/// Per-room overrides to the user's display name or avatar will be
+	/// preserved by the import process.
+	///
 	/// SECURITY NOTE: If the `avatar_url` field is set, Continuwuity will
 	/// perform a HTTP GET to the URL in the mapped claim and use the returned
 	/// file as the user's profile picture. Make sure your users are not able
@@ -2521,7 +2524,7 @@ pub struct OidcConfig {
 	/// When profile keys should be imported from the IDP's claims.
 	///
 	/// - "on_registration": Listed keys will be imported once, when the user
-	///   registers.
+	///   logs in for the first time and their shadow account is created.
 	/// - "on_login": Listed keys will be imported every time the user logs in.
 	///   Additionally, users will not be able to manually edit any listed keys
 	///   through their Matrix client.
diff --git a/src/service/oidc/mod.rs b/src/service/oidc/mod.rs
index 2cf8afbef..9b288c24a 100644
--- a/src/service/oidc/mod.rs
+++ b/src/service/oidc/mod.rs
@@ -302,15 +302,13 @@ impl Service {
 			} else {
 				return Ok(SessionCompletionStatus::NeedsUserId);
 			}
-		} else if let Some(preferred_username) = all_claims.get(&config.preferred_username_claim)
+		} else if let Some(preferred_username) = all_claims
+			.get(&config.preferred_username_claim)
+			.and_then(|claim| claim.as_str())
 		{
 			self.services
 				.users
-				.determine_registration_user_id(
-					Some(preferred_username.as_str().unwrap().to_owned()),
-					None,
-					None,
-				)
+				.determine_registration_user_id(Some(preferred_username.to_owned()), None, None)
 				.await
 				.map_err(|err| {
 					error!("Preferred username claim is not a valid localpart: {err}");
@@ -372,26 +370,26 @@ impl Service {
 						continue;
 					};
 
-					let value = if let Some(picture) = value.as_str()
+					let value = if let Some(picture_url) = value.as_str()
 						&& field == ProfileFieldName::AvatarUrl.as_str()
 						&& openidsubject_currentpictureurl
 							.get(&subject)
 							.await
 							.deserialized::<String>()
 							.ok()
-							.is_none_or(|current_picture| current_picture != picture)
+							.is_none_or(|current_picture| current_picture != picture_url)
 					{
-						match media.download_media(picture).await {
+						match media.download_media(picture_url).await {
 							| Ok((mxc, size)) => {
-								openidsubject_currentpictureurl.insert(&subject, picture);
-								info!(?mxc, ?size, "Downloaded profile picture");
+								openidsubject_currentpictureurl.insert(&subject, picture_url);
+								info!(?picture_url, ?mxc, ?size, "Downloaded profile picture");
 
 								ProfileFieldValue::AvatarUrl(mxc)
 							},
 							| Err(err) => {
 								warn!(
 									?claim,
-									?picture,
+									?picture_url,
 									"Failed to download profile picture: {err}"
 								);
 								continue;
diff --git a/src/service/users/remote.rs b/src/service/users/remote.rs
index 21be89e6e..c2c77967c 100644
--- a/src/service/users/remote.rs
+++ b/src/service/users/remote.rs
@@ -5,7 +5,7 @@ use ruma::{OwnedUserId, UserId};
 impl super::Service {
 	/// Record the existence of a remote user.
 	pub fn record_remote_user(&self, user_id: &UserId) {
-		assert!(self.services.globals.user_is_local(user_id), "user is not remote");
+		assert!(!self.services.globals.user_is_local(user_id), "user is not remote");
 
 		self.db.remoteuserid_remoteuser.insert(user_id, "");
 	}
diff --git a/src/web/pages/account/login.rs b/src/web/pages/account/login.rs
index c2079ac1e..b92e775bb 100644
--- a/src/web/pages/account/login.rs
+++ b/src/web/pages/account/login.rs
@@ -99,10 +99,6 @@ async fn route_login(
 			.await
 			.expect("should be able to serialize OIDC session");
 
-		if next.is_some() {
-			return response!(Redirect::to(redirect_url.as_str()));
-		}
-
 		LoginType::Oidc { redirect_url }
 	} else {
 		let (trusted_flow_status, untrusted_flow_status) =