mirror of
https://github.com/photoprism/photoprism.git
synced 2026-07-17 16:49:04 +00:00
9d0aca64b8
Add PHOTOPRISM_OIDC_PROMPT (--oidc-prompt) to forward the OpenID Connect "prompt" parameter (login, select_account, consent) on the authorization request, so a rejected user can re-authenticate or pick another account instead of being silently signed in again. Unsupported values (including "none", which would break interactive login) are dropped with a warning; empty preserves the seamless-SSO default.
42 lines
1.2 KiB
Go
42 lines
1.2 KiB
Go
package oidc
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestParsePrompt(t *testing.T) {
|
|
t.Run("Empty", func(t *testing.T) {
|
|
valid, invalid := ParsePrompt("")
|
|
assert.Nil(t, valid)
|
|
assert.Nil(t, invalid)
|
|
})
|
|
t.Run("SingleValue", func(t *testing.T) {
|
|
valid, invalid := ParsePrompt("login")
|
|
assert.Equal(t, []string{"login"}, valid)
|
|
assert.Nil(t, invalid)
|
|
})
|
|
t.Run("Combo", func(t *testing.T) {
|
|
valid, invalid := ParsePrompt(" select_account consent ")
|
|
assert.Equal(t, []string{"select_account", "consent"}, valid)
|
|
assert.Nil(t, invalid)
|
|
})
|
|
t.Run("Normalizes", func(t *testing.T) {
|
|
valid, invalid := ParsePrompt("LOGIN")
|
|
assert.Equal(t, []string{"login"}, valid)
|
|
assert.Nil(t, invalid)
|
|
})
|
|
t.Run("DropsInvalid", func(t *testing.T) {
|
|
valid, invalid := ParsePrompt("login bogus consent")
|
|
assert.Equal(t, []string{"login", "consent"}, valid)
|
|
assert.Equal(t, []string{"bogus"}, invalid)
|
|
})
|
|
t.Run("RejectsNone", func(t *testing.T) {
|
|
// "none" must not reach the provider: it would suppress the login UI and
|
|
// break the interactive sign-in this option exists to unblock.
|
|
valid, invalid := ParsePrompt("none")
|
|
assert.Nil(t, valid)
|
|
assert.Equal(t, []string{"none"}, invalid)
|
|
})
|
|
}
|