refactor(web-app-nextcloud): consolidate oidc.flavor under compose.services.oidc

Single source of truth at compose.services.oidc.flavor. Removes stray
root-level keys, deletes the _applications_nextcloud_oidc_flavor helper,
and switches all consumers (plugin toggles + PHP template) to direct
lookups. Also fixes inherited precedence bug on plugin.enabled filters
and corrects OICD/floavor typos.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

group_vars/all/00_general.yml

@@ -59,21 +59,6 @@ ASYNC_POLL:     "{{ 0 if ASYNC_ENABLED | bool else 10 }}"      # Don't wait for
 # default value if not set via CLI (-e) or in playbook vars
 allowed_applications: []
 
-# helper
-_applications_nextcloud_oidc_flavor: >-
-  {{
-    lookup(
-      'config',
-      'web-app-nextcloud',
-      'oidc.flavor',
-      (
-        'oidc_login'
-        if lookup('config', 'web-app-nextcloud', 'compose.services.ldap.enabled', False)
-        else 'sociallogin'
-      )
-    )
-  }}
-
 # Role-based access control
 # @See https://en.wikipedia.org/wiki/Role-based_access_control
 RBAC:

roles/web-app-nextcloud/config/main.yml

@@ -43,6 +43,11 @@ compose:
     oidc:
       enabled: true
       shared: true
+      # flavor decides which OIDC plugin should be used.
+      # Available options: oidc_login, sociallogin
+      # @see https://apps.nextcloud.com/apps/oidc_login
+      # @see https://apps.nextcloud.com/apps/sociallogin
+      flavor: "oidc_login"
     coturn:
       # Keep dedicated TURN provider statically discoverable so normal inventory
       # generation and local iteration always pull in web-svc-coturn.
@@ -154,12 +159,6 @@ compose:
       shared: true
     hcaptcha:
       enabled: "{{ HCAPTCHA_ENABLED | bool }}"
-  enabled:  "{{ lookup('config', 'web-app-nextcloud', 'compose.services.oidc.enabled', False) }}"   # Activate OIDC for Nextcloud
-  # floavor decides which OICD plugin should be used. 
-  # Available options: oidc_login, sociallogin
-  # @see https://apps.nextcloud.com/apps/oidc_login
-  # @see https://apps.nextcloud.com/apps/sociallogin
-  flavor:                       "oidc_login"                                    # Keeping on sociallogin because the other option is not implemented yet                                             
 default_quota:                 '1000000000'                                     # Quota to assign if no quota is specified in the OIDC response (bytes)
 legacy_login_mask:   
   enabled:                      False                                           # If true, then legacy  login mask is shown. Otherwise just SSO
@@ -171,8 +170,6 @@ performance:
     opcache_memory_consumption: "{{ ((ansible_facts['memtotal_mb'] | int) / 30)|int }}M" # Dynamic set memory consumption
 
 plugins_enabled:                true                                            # Implemented for speeding up testing and debugging process. For productive environments keep it true and steer the apps via the plugins config
-oidc:
-  flavor:                       "{{ _applications_nextcloud_oidc_flavor }}" 
 plugins:                                                  
 # List for Nextcloud Plugin Routine
 # Decides if plugins should be activated or deactivated
@@ -313,7 +310,7 @@ plugins:
     enabled: true
   oidc_login:
     # Nextcloud User OIDC: integrates OpenID Connect for user authentication (https://apps.nextcloud.com/apps/oidc_login)
-    enabled:    "{{ _applications_nextcloud_oidc_flavor=='oidc_login' | lower }}"
+    enabled:    "{{ lookup('config', 'web-app-nextcloud', 'compose.services.oidc.flavor') == 'oidc_login' }}"
     incompatible_plugins:  
       - user_oidc   # Will be disabled
       - sociallogin # Will be disabled
@@ -340,7 +337,7 @@ plugins:
       - fileslibreofficeedit
   sociallogin:
     # Nextcloud social login: allows authentication using social networks (https://apps.nextcloud.com/apps/sociallogin)
-    enabled:    "{{ _applications_nextcloud_oidc_flavor=='sociallogin' | lower }}"
+    enabled:    "{{ lookup('config', 'web-app-nextcloud', 'compose.services.oidc.flavor') == 'sociallogin' }}"
     incompatible_plugins:  
       - user_oidc   # Will be disabled
       - oidc_login  # Will be disabled
@@ -369,7 +366,7 @@ plugins:
       enabled:  true # Enables the LDAP User Directory Search
   user_oidc:
     # Nextcloud User OIDC: integrates OpenID Connect for user authentication (https://apps.nextcloud.com/apps/user_oidc)
-    enabled:    "{{ _applications_nextcloud_oidc_flavor=='user_oidc' | lower }}"
+    enabled:    "{{ lookup('config', 'web-app-nextcloud', 'compose.services.oidc.flavor') == 'user_oidc' }}"
     incompatible_plugins:  
       - oidc_login
       - sociallogin

roles/web-app-nextcloud/templates/config/oidc.config.php.j2

@@ -1,7 +1,7 @@
 <?php
-# Implementing OICD configuration
+# Implementing OIDC configuration
 
-{% if lookup('config',application_id, 'oidc.flavor') == "oidc_login" %}
+{% if lookup('config',application_id, 'compose.services.oidc.flavor') == "oidc_login" %}
 
 # Check out: https://github.com/pulsejet/nextcloud-oidc-login