Add Hugging Face OAuth2 provider to migration allow-list

[Meldiron]

What does this PR do?

Adds huggingface to the OAuth2Provider::PROVIDERS allow-list.

Appwrite server is adding a built-in Hugging Face OAuth2 provider (appwrite/appwrite#13123). Once that provider is enabled in app/config/oAuthProviders.php, it shows up in GET /project/oauth2-providers, and the Appwrite source enumerates it during a migration. Without an allow-list entry, OAuth2Provider::fromArray() returns null and Sources/Appwrite.php records:

{"code":500,"message":"No migration resource for OAuth2 provider 'huggingface'; skipped.","resourceName":"oauth2-provider","resourceGroup":"auth"}

addError marks the whole migration failed. Note the null check runs before isConfigured(), so this fires even for projects that never configured the provider — it breaks every migration, not just ones using Hugging Face. This is currently failing the Migrations E2E suite on the Appwrite PR.

Only clientId migrates (to the destination's huggingfaceAppid attribute); clientSecret is write-only and stays redacted per the existing policy. Hugging Face uses the default clientId/clientSecret field names and exposes no extra settings ('form' => false in the Appwrite config), so it needs no TARGET_SECRET fields — same shape as github.

Same change as #0eb1a58 (Add appwrite OAuth2 provider to migration allow-list).

Test Plan

• Added testFromArrayHuggingFace, mirroring testFromArrayAppwrite: asserts clientId lands on the app ID target, no secret fields are produced, and clientSecret is not copied into settings.
• testFromArrayNeverCopiesSecrets already iterates array_keys(OAuth2Provider::PROVIDERS), so it now covers the new key too.

Follow-up

Needs a 2.0.4 tag, then a composer.lock bump on appwrite/appwrite#13123 (its ^2.0.0 constraint already allows it).

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Adds Hugging Face to the explicit OAuth2 provider allow-list so migrations preserve its client ID without copying its write-only client secret.

• Maps huggingface.clientId to the destination application ID.
• Adds focused hydration, destination-field, configuration, and secret-exclusion assertions.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The new provider follows the established client-ID-only mapping, and the focused test verifies that the destination app ID is populated while secret data remains excluded.

Important Files Changed

Filename	Overview
src/Migration/Resources/Auth/OAuth2/OAuth2Provider.php	Adds a Hugging Face provider mapping consistent with the existing client-ID-only OAuth2 provider shape and secret-handling policy.
tests/Migration/Unit/Resources/OAuth2ProviderTest.php	Verifies Hugging Face hydration, application-ID mapping, configured state, and exclusion of the client secret.

_{Reviews (1): Last reviewed commit: "Add Hugging Face OAuth2 provider to migr..." | Re-trigger Greptile}