From 245b3aae5ffcef179862dae4310597a47014974b Mon Sep 17 00:00:00 2001
From: Raul Roberto da Silva <raul@4mdg.com.br>
Date: Wed, 4 Nov 2026 13:18:29 -0300
Subject: [PATCH 1/3] fix: don't crash every request when auth_source_manager
 is None in the session. #10733

---
 web/pgadmin/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/pgadmin/__init__.py b/web/pgadmin/__init__.py
index f5e2c329d43..038124a7e75 100644
--- a/web/pgadmin/__init__.py
+++ b/web/pgadmin/__init__.py
@@ -1006,7 +1006,7 @@ def before_request():
         # but the user session may still be active. Logout the user
         # to get the key again when login
         if config.SERVER_MODE and current_user.is_authenticated and \
-            'auth_source_manager' in session and \
+            session.get('auth_source_manager') and \
             session['auth_source_manager']['current_source'] not in \
             [KERBEROS, OAUTH2, WEBSERVER] and \
                 current_app.keyManager.get() is None and \

From 94313faf875fe6e5049a58f75d88dfc72fd81ee3 Mon Sep 17 00:00:00 2001
From: Raul Roberto da Silva <raul@4mdg.com.br>
Date: Wed, 4 Nov 2026 13:42:17 -0300
Subject: [PATCH 2/3] fix: treat a None auth_source_manager as an unknown
 source so the restart logout still applies. #10733

---
 web/pgadmin/__init__.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/web/pgadmin/__init__.py b/web/pgadmin/__init__.py
index 038124a7e75..bec48f8a907 100644
--- a/web/pgadmin/__init__.py
+++ b/web/pgadmin/__init__.py
@@ -1004,11 +1004,12 @@ def before_request():
                 return response
         # if the server is restarted the in memory key will be lost
         # but the user session may still be active. Logout the user
-        # to get the key again when login
+        # to get the key again when login. auth_source_manager is None while
+        # an OAuth2 login is pending: treat it as an unknown source.
         if config.SERVER_MODE and current_user.is_authenticated and \
-            session.get('auth_source_manager') and \
-            session['auth_source_manager']['current_source'] not in \
-            [KERBEROS, OAUTH2, WEBSERVER] and \
+            'auth_source_manager' in session and \
+            (session['auth_source_manager'] or {}).get('current_source') \
+            not in [KERBEROS, OAUTH2, WEBSERVER] and \
                 current_app.keyManager.get() is None and \
                 request.endpoint not in ('security.login', 'security.logout'):
             logout_user()

From 132ff54b218a32fa94d6daab0134a482cfd27eb3 Mon Sep 17 00:00:00 2001
From: Raul Roberto da Silva <raul@4mdg.com.br>
Date: Wed, 4 Nov 2026 14:42:31 -0300
Subject: [PATCH 3/3] fix: keep an authenticated user's auth source while a new
 login is pending. #10733

---
 web/pgadmin/authenticate/__init__.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/web/pgadmin/authenticate/__init__.py b/web/pgadmin/authenticate/__init__.py
index 223963ae802..a03c7ff47f0 100644
--- a/web/pgadmin/authenticate/__init__.py
+++ b/web/pgadmin/authenticate/__init__.py
@@ -187,7 +187,10 @@ def _login():
         auth_obj = AuthSourceManager(form, copy.deepcopy(
             config.AUTHENTICATION_SOURCES))
 
-    session['auth_source_manager'] = None
+    # An authenticated user keeps their current source until the new login
+    # succeeds: every request reads it, and None would break them.
+    if not current_user.is_authenticated:
+        session['auth_source_manager'] = None
 
     # The internal account whose password Flask-Security checks: it is
     # looked up the same way, by email and ignoring case.