Replace Google OAuth with generic OAuth/OIDC provider support

documentation/docs/advanced/authentication.mdx

@@ -1,11 +1,7 @@
 # Authenticate (Multi-User Setup)
 
-```mdx-code-block
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-```
 
-By default, most of the instructions for self-hosting Khoj assume a single user, and so the default configuration is to run in anonymous mode. However, if you want to enable authentication, you can do so either with with [Magic Links](#using-magic-links) or [Google OAuth](#using-google-oauth) as shown below. This can be helpful to make Khoj securely accessible to you and your team.
+By default, most of the instructions for self-hosting Khoj assume a single user, and so the default configuration is to run in anonymous mode. However, if you want to enable authentication, you can do so either with [Magic Links](#using-magic-links) or [OAuth / OIDC](#using-oauth--oidc) as shown below. This can be helpful to make Khoj securely accessible to you and your team.
 
 :::tip[Note]
 Remove the `--anonymous-mode` flag from your khoj start up command or docker-compose file to enable authentication.
@@ -43,32 +39,89 @@ It's still possible to use the magic links feature without Resend, but you'll ne
 
     A given magic link can only be used once. If the user tries to use it again, they'll be redirected to the login page to get a new magic link.
 
-## Using Google OAuth
+## Using OAuth / OIDC
+
+Khoj supports any OAuth 2.0 / OpenID Connect provider (Google, Authentik, Auth0, Keycloak, etc.) via a generic configuration.
+
+### Required environment variables
+
+| Variable | Description |
+|----------|-------------|
+| `GENERIC_OAUTH_ENABLED` | Set to `True` to enable OAuth |
+| `GENERIC_OAUTH_CLIENT_ID` | OAuth client ID from your provider |
+| `GENERIC_OAUTH_CLIENT_SECRET` | OAuth client secret from your provider |
+
+Set the **redirect URI** in your OAuth provider to:
+```
+https://your-khoj-domain/auth/callback/oauth
+```
+
+In addition to the above, you **must** configure endpoints in one of two ways:
+
+- **Option A (recommended):** Set `GENERIC_OAUTH_ISSUER` — Khoj auto-discovers all endpoints via OIDC.
+- **Option B:** Set `GENERIC_OAUTH_AUTHORIZATION_ENDPOINT` and `GENERIC_OAUTH_TOKEN_ENDPOINT` manually.
+
+Without at least one of these, OAuth login will not work.
+
+### Endpoint configuration
 
-For this method, you'll need to use the prod version of the Khoj package. You can install it as below:
+| Variable | Description | Required |
+|----------|-------------|----------|
+| `GENERIC_OAUTH_ISSUER` | OIDC issuer URL — enables auto-discovery of all endpoints | **Yes**, unless using manual endpoints below |
+| `GENERIC_OAUTH_AUTHORIZATION_ENDPOINT` | OAuth authorization endpoint | **Yes**, if no issuer set |
+| `GENERIC_OAUTH_TOKEN_ENDPOINT` | OAuth token endpoint | **Yes**, if no issuer set |
+| `GENERIC_OAUTH_USERINFO_ENDPOINT` | Userinfo endpoint | Recommended if no issuer set |
+| `GENERIC_OAUTH_JWKS_URI` | JWKS URI for token verification | Optional |
 
-<Tabs groupId="server" queryString>
-  <TabItem value="docker" label="Docker">
-  Update your `docker-compose.yml` to use the prod image
-      ```bash
-      image: ghcr.io/khoj-ai/khoj-cloud:latest
-      ```
-  </TabItem>
+### Other optional variables
 
-  <TabItem value="pip" label="Pip">
-  ```bash
-  pip install khoj[prod]
-  ```
-  </TabItem>
-</Tabs>
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `GENERIC_OAUTH_SCOPE` | OAuth scopes to request | `openid profile email` |
+| `GENERIC_OAUTH_PROVIDER_NAME` | Display name for the login button | `OAuth` |
+| `GENERIC_OAUTH_BUTTON_LABEL` | Custom login button label | `Continue with {provider_name}` |
 
-To set up your self-hosted Khoj with Google Auth, you need to create a project in the Google Cloud Console and enable the Google Auth API.
+### OIDC discovery mode (recommended)
 
-To implement this, you'll need to:
-1. [Create authorization credentials](https://developers.google.com/identity/sign-in/web/sign-in) for your application.
-2. Open your [Google cloud console](https://console.developers.google.com/apis/credentials) and create a configuration like below for the relevant `OAuth 2.0 Client IDs` project:
-![Google auth login project settings](https://github.com/khoj-ai/khoj/assets/65192171/9bcbf6f4-197d-4d0c-973a-c10b1331c892)
+If your provider supports OpenID Connect discovery, just set the issuer URL. Khoj will automatically fetch all endpoints from `{issuer}/.well-known/openid-configuration`.
 
-3. Configure these environment variables: `GOOGLE_CLIENT_SECRET`, and `GOOGLE_CLIENT_ID`. You can find these values in the Google cloud console, in the same place where you configured the authorized origins and redirect URIs.
+### Example: Google
 
-That's it! That should be all you have to do. Now, when you reload Khoj without `--anonymous-mode`, you should be able to use your Google account to sign in.
+1. Create OAuth 2.0 credentials in the [Google Cloud Console](https://console.developers.google.com/apis/credentials).
+2. Add `https://your-khoj-domain/auth/callback/oauth` as an authorized redirect URI.
+3. Set the following environment variables:
+
+```bash
+GENERIC_OAUTH_ENABLED=True
+GENERIC_OAUTH_CLIENT_ID=your-google-client-id
+GENERIC_OAUTH_CLIENT_SECRET=your-google-client-secret
+GENERIC_OAUTH_ISSUER=https://accounts.google.com
+GENERIC_OAUTH_PROVIDER_NAME=Google
+```
+
+### Example: Authentik
+
+1. Create an OAuth2/OIDC provider in your Authentik admin panel.
+2. Add `https://your-khoj-domain/auth/callback/oauth` as an authorized redirect URI.
+3. Set the following environment variables:
+
+```bash
+GENERIC_OAUTH_ENABLED=True
+GENERIC_OAUTH_CLIENT_ID=your-authentik-client-id
+GENERIC_OAUTH_CLIENT_SECRET=your-authentik-client-secret
+GENERIC_OAUTH_ISSUER=https://your-authentik-domain/application/o/khoj/
+GENERIC_OAUTH_PROVIDER_NAME=Authentik
+```
+
+### Manual endpoint mode
+
+For providers that don't support OIDC discovery, set the endpoints manually instead of `GENERIC_OAUTH_ISSUER`:
+
+```bash
+GENERIC_OAUTH_ENABLED=True
+GENERIC_OAUTH_CLIENT_ID=your-client-id
+GENERIC_OAUTH_CLIENT_SECRET=your-client-secret
+GENERIC_OAUTH_AUTHORIZATION_ENDPOINT=https://provider.example/authorize
+GENERIC_OAUTH_TOKEN_ENDPOINT=https://provider.example/token
+GENERIC_OAUTH_USERINFO_ENDPOINT=https://provider.example/userinfo
+```

documentation/docs/get-started/privacy-security.md

@@ -20,7 +20,7 @@ Here's what to consider if you're using Khoj, whether self-hosted or on our clou
 Self-hosting isn't for everyone, so we've still taken steps to make Khoj privacy-friendly, even if you choose to use our [cloud offering](https://app.khoj.dev). Here's what to consider when using Khoj Cloud:
 1. Your embeddings are generated by an open source model within our own dedicated endpoint [hosted on AWS with Huggingface](https://huggingface.co/inference-endpoints/dedicated). There's zero persistent memory to the Huggingface Inference endpoints (it's stateless).
 1. Your embeddings and the associated raw text are stored in a secure Postgres DB in our private AWS cloud. Your data is sharded on a unique user ID. We store the raw text in your files to improve file syncing and provide context when you chat with Khoj.
-1. When you use the single-sign-on option with Google, we only receive your name, a link to your profile photo, and your email address.
+1. When you use single-sign-on (OAuth/OIDC), we only receive your name, a link to your profile photo, and your email address from the identity provider.
 
 You can see our full privacy policy [here](https://khoj.dev/privacy-policy).
 

src/interface/web/app/common/layoutHelper.tsx

@@ -4,12 +4,12 @@ export function ContentSecurityPolicy() {
             httpEquiv="Content-Security-Policy"
             content="default-src 'self' https://assets.khoj.dev;
                media-src * blob:;
-               script-src 'self' https://assets.khoj.dev https://app.chatwoot.com https://accounts.google.com 'unsafe-inline' 'unsafe-eval';
-               connect-src 'self' blob: https://ipapi.co/json ws://localhost:42110 https://accounts.google.com;
-               style-src 'self' https://assets.khoj.dev 'unsafe-inline' https://fonts.googleapis.com https://accounts.google.com;
-               img-src 'self' data: blob: https://*.khoj.dev https://accounts.google.com https://*.googleusercontent.com https://*.google.com/ https://*.gstatic.com;
+               script-src 'self' https://assets.khoj.dev https://app.chatwoot.com 'unsafe-inline' 'unsafe-eval';
+               connect-src 'self' blob: https://ipapi.co/json ws://localhost:42110;
+               style-src 'self' https://assets.khoj.dev 'unsafe-inline' https://fonts.googleapis.com;
+               img-src 'self' data: blob: https://*.khoj.dev https://*.googleusercontent.com;
                font-src 'self' https://assets.khoj.dev https://fonts.gstatic.com;
-               frame-src 'self' https://accounts.google.com https://app.chatwoot.com;
+               frame-src 'self' https://app.chatwoot.com;
                child-src 'self' https://app.chatwoot.com;
                object-src 'none';"
         ></meta>