chore: check for prompt=none in authentication requests

server/handlers.go

@@ -138,14 +138,27 @@ func (s *Server) constructDiscovery() discovery {
 func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	// Extract the arguments
-	if err := r.ParseForm(); err != nil {
-		s.logger.ErrorContext(r.Context(), "failed to parse arguments", "err", err)
+	authReq, err := s.parseAuthorizationRequest(r)
+	if err != nil {
+		s.logger.ErrorContext(r.Context(), "failed to parse authorization request", "err", err)
+
+		switch authErr := err.(type) {
+		case *redirectedAuthErr:
+			authErr.Handler().ServeHTTP(w, r)
+		case *displayedAuthErr:
+			s.renderError(r, w, authErr.Status, err.Error())
+		default:
+			panic("unsupported error type")
+		}
+
+		return
+	}
 
-		s.renderError(r, w, http.StatusBadRequest, err.Error())
+	if authReq.Prompt == "none" {
+		newRedirectedAuthErr(authReq, "login_required", "").Handler().ServeHTTP(w, r)
 		return
 	}
 
-	connectorID := r.Form.Get("connector_id")
 	connectors, err := s.storage.ListConnectors(ctx)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "failed to get list of connectors", "err", err)
@@ -162,9 +175,9 @@ func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Redirect if a client chooses a specific connector_id
-	if connectorID != "" {
+	if authReq.ConnectorID != "" {
 		for _, c := range connectors {
-			if c.ID == connectorID {
+			if c.ID == authReq.ConnectorID {
 				connURL.Path = s.absPath("/auth", url.PathEscape(c.ID))
 				http.Redirect(w, r, connURL.String(), http.StatusFound)
 				return

server/oauth2.go

@@ -77,6 +77,10 @@ func (err *redirectedAuthErr) Handler() http.Handler {
 	return http.HandlerFunc(hf)
 }
 
+func newRedirectedAuthErr(authReq *storage.AuthRequest, typ, format string, a ...interface{}) *redirectedAuthErr {
+	return &redirectedAuthErr{authReq.State, authReq.RedirectURI, typ, fmt.Sprintf(format, a...)}
+}
+
 func tokenErr(w http.ResponseWriter, typ, description string, statusCode int) error {
 	data := struct {
 		Error       string `json:"error"`
@@ -612,6 +616,7 @@ func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthReques
 		State:               state,
 		Nonce:               nonce,
 		ForceApprovalPrompt: q.Get("approval_prompt") == "force",
+		Prompt:              q.Get("prompt"),
 		Scopes:              scopes,
 		RedirectURI:         redirectURI,
 		ResponseTypes:       responseTypes,

storage/storage.go

@@ -211,6 +211,7 @@ type AuthRequest struct {
 	// on all requests. The server cannot cache their initial action for subsequent
 	// attempts.
 	ForceApprovalPrompt bool
+	Prompt              string
 
 	Expiry time.Time