Fix generic OAuth login error 'NoneType object has no attribute token'

- When using generic OAuth (e.g. Authentik), the `register_user_from_generic_oauth` function creates a `GenericOIDCSession` with an explicit token but no blueprint to avoid race conditions.
- Flask-Dance's `OAuth2Session` assumes a blueprint is always present and tries to access `self.blueprint.token` in its `token` property, causing a crash when blueprint is None.
- This fix overrides the `token` property in `GenericOIDCSession` to return the explicit token if available, and adds a deleter to handle Flask-Dance's initialization logic.
- This ensures the session works correctly even when used independently of a blueprint for user registration.

Fixes #715
Fixes #800

Author: crocodilestick

CONTRIBUTORS

@@ -12,7 +12,7 @@ Copyright (C) 2024-2025 Calibre-Web Automated contributors
 # Upstream Contributors (janeczku/calibre-web)
 
 - OzzieIsaacs (anon) (2758 commits)
-- Ozzie Isaacs (anon) (263 commits)
+- Ozzie Isaacs (anon) (264 commits)
 - cbartondock (96 commits)
 - idalin (69 commits)
 - cervinko (68 commits)

cps/oauth_bb.py

@@ -69,15 +69,49 @@ class GenericOIDCSession(BaseOAuth2Session):
     1. SSL verification based on OAUTH_SSL_STRICT setting
     2. Lenient scope validation (order-independent comparison)
     3. Normalizes scope in token response to prevent mismatch warnings
+    4. Explicit token usage without blueprint (Issue #715)
     """
     def __init__(self, *args, **kwargs):
+        self._explicit_token = kwargs.get('token')
         super().__init__(*args, **kwargs)
         # Configure SSL verification for all requests
         self.verify = constants.OAUTH_SSL_STRICT
 
         # Register compliance hook to normalize scope in token response (Issue #715)
         # This prevents "scope_changed" warnings when Authentik returns scopes in different order
         self.register_compliance_hook('access_token_response', self._normalize_token_scope)
+
+    @property
+    def token(self):
+        """
+        Override token property to support explicit token usage without blueprint.
+        Flask-Dance's token property crashes if blueprint is None.
+        """
+        if self._explicit_token:
+            return self._explicit_token
+        return self.blueprint.token
+
+    @token.setter
+    def token(self, value):
+        """
+        Allow setting token (required for token refresh/update).
+        This mimics cached_property behavior by shadowing the blueprint token.
+        """
+        self._explicit_token = value
+
+    @token.deleter
+    def token(self):
+        """
+        Handle deletion of token.
+        Flask-Dance deletes the token in __init__ to ensure it uses the blueprint's token.
+        We want to preserve our explicit token if it was passed, so we do nothing here
+        if we are in explicit mode.
+        """
+        # If we are not in explicit mode, we might want to clear something?
+        # But since we store everything in _explicit_token or delegate to blueprint,
+        # and _explicit_token is what we want to keep, we can just ignore the delete
+        # if it's coming from Flask-Dance's init.
+        pass
 
     def _normalize_token_scope(self, response):
         """
@@ -116,6 +150,14 @@ def request(self, method, url, *args, **kwargs):
         """Override request to ensure SSL verification is applied"""
         if 'verify' not in kwargs:
             kwargs['verify'] = self.verify
+            
+        # If we have an explicit token and no blueprint, we need to handle request manually
+        # to avoid Flask-Dance's dependency on blueprint
+        if self._explicit_token and not self.blueprint:
+            # Bypass Flask-Dance's request method which requires blueprint
+            # Call requests_oauthlib.OAuth2Session.request directly
+            return super(BaseOAuth2Session, self).request(method, url, *args, **kwargs)
+            
         return super().request(method, url, *args, **kwargs)