fix(auth): ask the provider for a fresh sign-in when claiming a profile

src/lib/auth/__tests__/oidc.test.ts

@@ -253,6 +253,23 @@ describe("buildAuthorizationUrl", () => {
     expect(url.searchParams.get("code_challenge")).toBe("challenge-1");
     expect(url.searchParams.get("code_challenge_method")).toBe("S256");
     expect(url.searchParams.get("scope")).toBe(config.scopes);
+    expect(url.searchParams.has("prompt")).toBe(false);
+  });
+
+  it("asks for a fresh sign-in only when told to", () => {
+    configureEnv();
+    const url = new URL(
+      buildAuthorizationUrl({
+        metadata: METADATA_DOC,
+        config: getOidcConfig()!,
+        state: "state-1",
+        nonce: "nonce-1",
+        codeChallenge: "challenge-1",
+        redirectUri: "https://healthlog.example.com/api/auth/oidc/callback",
+        forceLogin: true,
+      }),
+    );
+    expect(url.searchParams.get("prompt")).toBe("login");
   });
 });
 

src/lib/auth/oidc.ts

@@ -237,6 +237,13 @@ export function buildAuthorizationUrl(params: {
   nonce: string;
   codeChallenge: string;
   redirectUri: string;
+  /**
+   * Ask the provider to authenticate afresh (`prompt=login`, OpenID Connect
+   * Core 3.1.2.1) instead of reusing the browser's provider session. A claim
+   * hands a profile to whoever signs in, so it must be the person at the
+   * keyboard now, not a session someone else left open in this browser.
+   */
+  forceLogin?: boolean;
 }): string {
   const url = new URL(params.metadata.authorization_endpoint);
   url.search = new URLSearchParams({
@@ -248,6 +255,7 @@ export function buildAuthorizationUrl(params: {
     nonce: params.nonce,
     code_challenge: params.codeChallenge,
     code_challenge_method: "S256",
+    ...(params.forceLogin ? { prompt: "login" } : {}),
   }).toString();
   return url.toString();
 }