Fix: Relax OAuth scope validation to prevent 500 errors with Authentik

Sets OAUTHLIB_RELAX_TOKEN_SCOPE environment variable to allow providers to return fewer scopes than requested without raising an exception.

Author: crocodilestick

cps/oauth_bb.py

@@ -33,8 +33,13 @@
 
 import json
 import requests
+import os
 from functools import wraps
 
+# Relax OAuthlib scope validation to prevent errors when providers return different scopes
+# This fixes Issue #715 where missing 'groups' scope causes 500 Internal Server Error
+os.environ['OAUTHLIB_RELAX_TOKEN_SCOPE'] = '1'
+
 from flask import session, request, make_response, abort
 from flask import Blueprint, flash, redirect, url_for
 from flask_babel import gettext as _