feat(auth): send OIDC login_hint for direct email login (PLT-1666) - #2950
Closed
brayansdt wants to merge 1 commit into
Closed
feat(auth): send OIDC login_hint for direct email login (PLT-1666)#2950brayansdt wants to merge 1 commit into
brayansdt wants to merge 1 commit into
Conversation
The SDK forwards the email entered in the embedded prompt as the custom `email` query param on /authorize. On the hosted Ory/Hydra login path Hydra does not relay custom params to the login UI, so the branded page lost the email and restarted at step 0 instead of resuming at the OTP screen (Auth0 parity). Also set the standard `login_hint` (which Hydra does relay onto the login request, and Kratos surfaces on the login flow) alongside the existing `email` param. Additive — the Auth0 path still uses `email` and is unaffected. Mirrored in the standalone/NextAuth popup builder. Covered by a new Auth.test.ts case. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
View your CI Pipeline Execution ↗ for commit 4fa1a28
☁️ Nx Cloud last updated this comment at |
Contributor
Author
|
Closing in favour of an SDK-free fix. Rather than change the SDK (which needs every game integration to upgrade), we promote the SDK's custom |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
On the hosted Ory login popup, after the user enters their email in the embedded prompt the popup restarts at step 0 instead of resuming at the OTP screen (Auth0 opened straight on the code screen). PLT-1666.
Root cause: the SDK forwards the email as the custom
emailquery param on/authorize. On the Ory/Hydra path Hydra does not relay custom params to the login UI, so the branded page only ever seeslogin_challengeand starts over.Change
Additionally set the standard OIDC
login_hint(= the email) on the popup/authorize, alongside the existingemail/directparams. Hydra does relaylogin_hintonto the login request, and Kratos surfaces it on the login flow, so the branded page can pre-fill + auto-send the code. Mirrored in the standalone/NextAuth popup builder.Auth.tsbuildExtraQueryParams(main popup path)login/standalone.tsbuildAuthorizationUrl(standalone path)Additive and Auth0-safe: the Auth0 path still consumes
email;login_hintis just an extra standard param it ignores/pre-fills harmlessly.Paired change
Consumed by the branded page in passport-login (reads
oauth2_login_request.oidc_context.login_hintoff the flow and auto-sends the code). This SDK change is a no-op until that lands, and vice-versa.Scope
Email one-time-code method only. Social method resume (no OIDC-standard method hint through Hydra) is a separate follow-up.
Tests
Auth.test.ts— new case assertslogin_hintis forwarded for direct email login. Full suite green (20/20);tsc/eslint clean.