@@ -0,0 +1,10 @@
+---
+'@object-ui/auth': patch
+---
+
+fix(auth): the sign-in page reads the sign-in methods the server has now, not the ones it had when the tab was opened (#30299)
+
+Clause-②: no
+Metadata-protocol: none
+
+The auth client kept the first `/auth/config` answer for the life of the page. An administrator who turned email and password off on the Authentication settings page (with another way in configured) and then signed out was shown the email and password form on the sign-in page, from the copy read while signed in, although the server refuses that form. The client now forgets the cached config whenever the tab is left without a session: on sign-out, and when a session read finds none (an expired session reaches the sign-in page without a sign-out). Readers on one page still share one request, and nothing changes while a session lasts.
@@ -558,6 +558,52 @@ describe('createAuthClient — getConfig single-flight / cache / retry (#2625)',
   });
 });
 
+describe('createAuthClient — getConfig is read fresh once the tab has no session (objectstack#30299)', () => {
+  // The settings page turns sign-in doors on and off while the server runs,
+  // so the copy cached during a signed-in stretch is not the sign-in page's.
+  function configServer(emailPasswordEnabled: { value: boolean }) {
+    return createMockFetch({
+      '/sign-out': { body: { success: true } },
+      '/get-session': { body: null },
+      get '/config'() {
+        return { body: { data: { emailPassword: { enabled: emailPasswordEnabled.value } } } };
+      },
+    });
+  }
+  const configReads = (calls: Array<{ url: string }>) => calls.filter((c) => c.url.includes('/config'));
+
+  it('keeps the cached config while the session lasts, and reads it again after sign-out', async () => {
+    const enabled = { value: true };
+    const { mockFn, calls } = configServer(enabled);
+    const client = createAuthClient({ baseURL: 'http://localhost/api/auth', fetchFn: mockFn });
+
+    expect((await client.getConfig()).emailPassword?.enabled).toBe(true);
+    // An administrator turns email and password off from the settings page.
+    enabled.value = false;
+    expect((await client.getConfig()).emailPassword?.enabled).toBe(true);
+    expect(configReads(calls)).toHaveLength(1);
+
+    await client.signOut();
+
+    expect((await client.getConfig()).emailPassword?.enabled).toBe(false);
+    expect(configReads(calls)).toHaveLength(2);
+  });
+
+  it('reads it again after a session read finds no session (an expired session never signs out)', async () => {
+    const enabled = { value: true };
+    const { mockFn, calls } = configServer(enabled);
+    const client = createAuthClient({ baseURL: 'http://localhost/api/auth', fetchFn: mockFn });
+
+    expect((await client.getConfig()).emailPassword?.enabled).toBe(true);
+    enabled.value = false;
+
+    expect(await client.getSession()).toBeNull();
+
+    expect((await client.getConfig()).emailPassword?.enabled).toBe(false);
+    expect(configReads(calls)).toHaveLength(2);
+  });
+});
+
 describe('createAuthClient — signInWithProvider watchdog (#2626)', () => {
   it('rejects with a timeout error when the sign-in request never returns', async () => {
     vi.useFakeTimers();
 
@@ -491,16 +491,27 @@ export function createAuthClient(config: AuthClientConfig): AuthClient {
     }
   }
 
-  // Auth config is static per server boot: single-flight + cache the success
-  // so the login page's multiple consumers (LoginForm, SocialSignInButtons,
-  // RegisterForm) share ONE request instead of three. Failures RETRY with a
-  // short backoff before rejecting — a first-load failure used to render the
-  // page without its SSO buttons, which strands SSO-only users on a password
-  // wall they have no password for (#2625). A final failure clears the cache
-  // so the next caller starts a fresh cycle.
+  // Single-flight + cache the success so the login page's multiple consumers
+  // (LoginForm, SocialSignInButtons, RegisterForm) share ONE request instead
+  // of three. Failures RETRY with a short backoff before rejecting — a
+  // first-load failure used to render the page without its SSO buttons, which
+  // strands SSO-only users on a password wall they have no password for
+  // (#2625). A final failure clears the cache so the next caller starts a
+  // fresh cycle.
+  //
+  // The config is NOT static per server boot: an administrator changes the
+  // sign-in doors from the settings page (email and password, the Google
+  // provider) and the server answers the new set at once. So the cache lives
+  // for one signed-in stretch only — `forgetConfig()` runs whenever this tab
+  // is left without a session (sign-out, or a session read that finds none),
+  // and the sign-in page that follows reads the doors the server has now
+  // instead of the ones it had when the tab was opened.
   const CONFIG_RETRY_DELAYS_MS = [500, 1500, 3500];
   const CONFIG_ATTEMPT_TIMEOUT_MS = 8_000;
   let configPromise: Promise<AuthPublicConfig> | null = null;
+  const forgetConfig = () => {
+    configPromise = null;
+  };
 
   async function loadConfigWithRetry(): Promise<AuthPublicConfig> {
     let lastError: unknown;
@@ -649,6 +660,11 @@ export function createAuthClient(config: AuthClientConfig): AuthClient {
       // `providerLogoutURL`); without a provider the answer is
       // `{ success: true }` and the caller's in-app route to the sign-in page
       // stays as it was.
+      //
+      // The sign-in page comes next, so it must read the doors the server
+      // has now; forgotten before the request, so a failed sign-out (which
+      // still leaves this tab without its token) forgets it too.
+      forgetConfig();
       const { data, error } = await betterAuth.signOut({ callbackURL: resolveSpaRoute('/login') });
       TokenStorage.clear();
       if (error) {
@@ -721,6 +737,10 @@ export function createAuthClient(config: AuthClientConfig): AuthClient {
           }
         } catch { /* network hiccup — treat as signed out, keep the token */ }
       }
+      // No session: whatever reads the config next is the sign-in page (a
+      // session that expired lands there without a sign-out), so it reads it
+      // fresh rather than the copy cached while signed in.
+      forgetConfig();
       return null;
     },