ThePalaceProject / web-patron / 27374726958

88%

main: 88%

push

github

Support alternate OIDC auth flow via "prompt" param (PP-4429) (#146)

## Description

> [!NOTE]
> The feature described here is basically equivalent to a regular sign
in attempt in the absence of [a supporting change in the Palace Manager
(PR 3452)](https://github.com/ThePalaceProject/circulation/pull/3452).

This adds a "Use a different account" escape hatch to the OIDC error and
cancel screens. Clicking it retries authentication with the
`prompt=select_account` query parameter added to the authorization
request URL, which instructs the OIDC provider to show its account
chooser regardless of any existing session. The normal sign-in flow is
unaffected.

<img width="331" height="329" alt="image"
src="https://github.com/user-attachments/assets/149bbd70-dbb3-46d8-8157-5fb998fcd24d"
/>


Also fixes the OIDC redirect URL, now correctly constructing it using
`URL`/`searchParams` rather than string concatenation.

## Motivation and Context

When a library uses OIDC for sign-in (e.g. Google SSO), the client
auto-redirects to the identity provider. If the user is already signed
into a non-permitted account, authentication fails and they land on the
error screen with only a "Try Again" button — which retries the same
redirect and fails again.

[Jira PP-4429]

## How Has This Been Tested?

- New tests cover the "Use a different account" button appearing in both
the error and cancel states, and verify that clicking it navigates to
the correct URL with `prompt=select_account`.
- Existing OIDC handler tests updated to reflect the corrected URL
format (`?` separator instead of `&`).
- Manual local testing to ensure that the `prompt=select_account` query
param makes it through to the Palace Manager.
- All new and existing tests passed.
- CI tests and checks pass.

## Checklist:

- N/A - I have updated the documentation accordingly.
- [x] All new and existing tests passed.

223 of 258 branches covered (86.43%)

Branch coverage included in aggregate %.

357 of 401 relevant lines covered (89.03%)

31.6 hits per line