Administrators reviewing which OneDev accounts to deactivate need to know how each account is configured to sign in. The user API currently omits that information.

Add an authenticationSources array to GET /~api/users/{userId} and GET /~api/users/me. Include the local password source, configured external password authenticator, or linked SSO provider names as applicable. An account can have multiple sources.

Keep the existing access checks and omit the field from the user list. The field describes configured sign-in sources and contains no credentials.