fix(auth-ui): preserve OIDC requestId across ceremony-continuation links

A mid-OIDC user who continued the ceremony via certain links/redirects lost the requestId and dead-ended at the default post-login redirect (cloud portal) instead of returning to the relying party (e.g. datumctl).

- accounts: 'Add another account' / 'Add an account' now thread requestId. - recovery hook (useAuthErrorRecovery/useAuthActionRecovery): the 'Sign in again' / 'Start over' links on every ceremony screen (setup/*, login/verify/*, login/mfa) now carry requestId + organization. - password: the SESSION_EXPIRED 'Sign in again' link threads requestId + organization. - broken-session guard redirects (setup/authenticator, login/method) preserve it.

withQuery drops undefined, so non-OIDC flows keep the bare /login. Audited the full surface against the Zitadel login-v2 pattern; the query-carrying links (method chooser, passkey, OTP resend, BackLink, Not-you, signup<->login) were already correct.

Author: yahyafakhroji

app/hooks/__tests__/use-auth-action-recovery.test.tsx

@@ -12,9 +12,17 @@ import { describe, it, expect, vi } from 'vitest';
 vi.mock('@/utils/errors/auth-error-messages', () => ({
   useAuthErrorMessage: () => (code?: string) => (code ? `msg:${code}` : undefined),
 }));
+// The mock echoes the ctx it received into the recovery `to`, so a test can assert the
+// wrapper FORWARDS the OIDC ceremony context (requestId/organization) down to
+// useAuthErrorRecovery (real implementation threads it onto /login).
 vi.mock('@/utils/errors/auth-error-recovery', () => ({
-  useAuthErrorRecovery: () => (code?: string) =>
-    code === 'SESSION_EXPIRED' ? { to: '/login', label: 'Sign in again' } : undefined,
+  useAuthErrorRecovery: (ctx?: { requestId?: string; organization?: string }) => (code?: string) =>
+    code === 'SESSION_EXPIRED'
+      ? {
+          to: ctx?.requestId ? `/login?requestId=${ctx.requestId}` : '/login',
+          label: 'Sign in again',
+        }
+      : undefined,
 }));
 
 describe('useAuthActionRecovery', () => {
@@ -35,4 +43,25 @@ describe('useAuthActionRecovery', () => {
     expect(result.current.message).toBeUndefined();
     expect(result.current.recovery).toBeUndefined();
   });
+
+  // OIDC ceremony preservation: the wrapper forwards the in-scope ceremony context
+  // (requestId/organization) to useAuthErrorRecovery so the recovery <Link> returns the
+  // user to the relying party. The mock echoes requestId into `to` to prove forwarding.
+  it('forwards the ceremony ctx (requestId) to the recovery resolver', () => {
+    const { result } = renderHook(() =>
+      useAuthActionRecovery(
+        { error: 'SESSION_EXPIRED' },
+        { requestId: 'rq1', organization: 'acme' }
+      )
+    );
+    expect(result.current.recovery).toEqual({
+      to: '/login?requestId=rq1',
+      label: 'Sign in again',
+    });
+  });
+
+  it('yields a bare /login recovery when no ctx is forwarded', () => {
+    const { result } = renderHook(() => useAuthActionRecovery({ error: 'SESSION_EXPIRED' }));
+    expect(result.current.recovery).toEqual({ to: '/login', label: 'Sign in again' });
+  });
 });

app/hooks/use-auth-action-recovery.ts

@@ -14,9 +14,15 @@ export interface AuthActionRecovery {
 // the SAME code, so an adopting route can render an inline banner + a recovery
 // <Link> inside <AuthCeremony>. Like useAuthActionError it fires NO toast — the
 // inline-only surface stands (the recovery link is ADDITIVE, not a toast).
-export function useAuthActionRecovery(actionData: unknown): AuthActionRecovery {
+export function useAuthActionRecovery(
+  actionData: unknown,
+  ctx?: { requestId?: string; organization?: string }
+): AuthActionRecovery {
   const getErrorMessage = useAuthErrorMessage();
-  const getRecovery = useAuthErrorRecovery();
+  // Forward the in-scope OIDC ceremony context so the recovery <Link> preserves
+  // requestId/organization (mid-OIDC users return to the relying party, not the
+  // default post-login redirect). undefined ctx → bare /login (non-OIDC flows).
+  const getRecovery = useAuthErrorRecovery(ctx);
   const code = (actionData as { error?: string } | undefined)?.error;
   return { message: getErrorMessage(code), recovery: getRecovery(code) };
 }