Fix: handle social account sync groups claim sent as str

src/paperless/signals.py

@@ -67,6 +67,10 @@ def handle_social_account_updated(sender, request, sociallogin, **kwargs):
             )
             or []
         )
+
+    if isinstance(social_account_groups, str):
+        social_account_groups = [social_account_groups]
+
     if settings.SOCIAL_ACCOUNT_SYNC_GROUPS and social_account_groups is not None:
         groups = Group.objects.filter(name__in=social_account_groups)
         logger.debug(

src/paperless/tests/test_signals.py

@@ -295,6 +295,43 @@ class TestSyncSocialLoginGroups(TestCase):
 
         self.assertEqual(list(user.groups.all()), [group])
 
+    @override_settings(
+        SOCIAL_ACCOUNT_SYNC_SUPERUSER_GROUP="admin",
+        SOCIAL_ACCOUNT_SYNC_STAFF_GROUP="admin",
+    )
+    def test_sync_superuser_claim_no_substring_match(self) -> None:
+        """
+        GIVEN:
+            - Configured superuser group sync
+            - Provider emits the groups claim as a bare string, and the user's
+              only group merely *contains* the configured name
+        WHEN:
+            - Social login updated via signal
+        THEN:
+            - User is not promoted, since only an exact group match counts
+        """
+        user = User.objects.create_user(
+            username="testuser",
+            is_superuser=False,
+            is_staff=False,
+        )
+        sociallogin = Mock(
+            user=user,
+            account=Mock(
+                extra_data={
+                    "groups": "paperless-admins-readonly",
+                },
+            ),
+        )
+        handle_social_account_updated(
+            sender=None,
+            request=HttpRequest(),
+            sociallogin=sociallogin,
+        )
+        user.refresh_from_db()
+        self.assertFalse(user.is_superuser)
+        self.assertFalse(user.is_staff)
+
     @override_settings(
         SOCIAL_ACCOUNT_SYNC_SUPERUSER_GROUP="admin-group",
         SOCIAL_ACCOUNT_SYNC_STAFF_GROUP=None,