diff --git a/packages/better-auth/src/plugins/oidc-provider/authorize.ts b/packages/better-auth/src/plugins/oidc-provider/authorize.ts index 3957f2e4a1..016cc512fe 100644 --- a/packages/better-auth/src/plugins/oidc-provider/authorize.ts +++ b/packages/better-auth/src/plugins/oidc-provider/authorize.ts @@ -4,7 +4,7 @@ import { getSessionFromCtx } from "../../api"; import { generateRandomString } from "../../crypto"; import { getClient } from "./index"; import type { AuthorizationQuery, OIDCOptions } from "./types"; -import { parsePrompt } from './utils/prompt' +import { parsePrompt } from "./utils/prompt"; function formatErrorURL(url: string, error: string, description: string) { return `${ @@ -217,7 +217,7 @@ export async function authorize( }) .then((res) => !!res?.consentGiven); - const promptSet = parsePrompt(query.prompt ?? ''); + const promptSet = parsePrompt(query.prompt ?? ""); // Handle prompt=none per OIDC spec 3.1.2.1 // The Authorization Server MUST NOT display any authentication or consent UI @@ -297,30 +297,30 @@ export async function authorize( ); } - if (requireLogin) { - await ctx.setSignedCookie( - "oidc_login_prompt", - JSON.stringify(ctx.query), - ctx.context.secret, - { - maxAge: 600, - path: "/", - sameSite: "lax", - } - ) - await ctx.setSignedCookie("oidc_consent_prompt", code, ctx.context.secret, { - maxAge: 600, - path: "/", - sameSite: "lax", - }); + if (requireLogin) { + await ctx.setSignedCookie( + "oidc_login_prompt", + JSON.stringify(ctx.query), + ctx.context.secret, + { + maxAge: 600, + path: "/", + sameSite: "lax", + }, + ); + await ctx.setSignedCookie("oidc_consent_prompt", code, ctx.context.secret, { + maxAge: 600, + path: "/", + sameSite: "lax", + }); - const loginURI = `${options.loginPage}?${new URLSearchParams({ - client_id: client.clientId, - code, - state: query.state, - }).toString()}`; - return handleRedirect(loginURI); - } + const loginURI = `${options.loginPage}?${new URLSearchParams({ + client_id: client.clientId, + code, + state: query.state, + }).toString()}`; + return handleRedirect(loginURI); + } // If consent is not required, redirect with the code immediately if (!requireConsent) { diff --git a/packages/better-auth/src/plugins/oidc-provider/index.ts b/packages/better-auth/src/plugins/oidc-provider/index.ts index 9e2a751444..b4506bcdf0 100644 --- a/packages/better-auth/src/plugins/oidc-provider/index.ts +++ b/packages/better-auth/src/plugins/oidc-provider/index.ts @@ -20,7 +20,7 @@ import { } from "../../crypto"; import { mergeSchema } from "../../db"; import type { jwt } from "../jwt"; -import { getJwtToken } from '../jwt'; +import { getJwtToken } from "../jwt"; import { authorize } from "./authorize"; import type { OAuthApplication } from "./schema"; import { schema } from "./schema"; @@ -32,7 +32,7 @@ import type { OIDCOptions, } from "./types"; import { defaultClientSecretHasher } from "./utils"; -import { parsePrompt } from './utils/prompt' +import { parsePrompt } from "./utils/prompt"; const getJwtPlugin = (ctx: GenericEndpointContext) => { return ctx.context.options.plugins?.find( diff --git a/packages/better-auth/src/plugins/oidc-provider/oidc.test.ts b/packages/better-auth/src/plugins/oidc-provider/oidc.test.ts index 8cbb46cb25..0359d3b79d 100644 --- a/packages/better-auth/src/plugins/oidc-provider/oidc.test.ts +++ b/packages/better-auth/src/plugins/oidc-provider/oidc.test.ts @@ -784,8 +784,8 @@ describe("oidc", async () => { }); describe("cookie persistence bug (issue #4594)", () => { - // Reproduce issue #4594: oidc_login_prompt cookie persists after OIDC flow - // and causes subsequent normal logins to redirect to OIDC client + // Reproduce issue #4594: oidc_login_prompt cookie persists after OIDC flow + // and causes subsequent normal logins to redirect to OIDC client it("should not redirect to OIDC client on subsequent normal logins", async ({ expect, }) => { diff --git a/packages/better-auth/src/plugins/oidc-provider/types.ts b/packages/better-auth/src/plugins/oidc-provider/types.ts index 1645f0a105..4c39047fbd 100644 --- a/packages/better-auth/src/plugins/oidc-provider/types.ts +++ b/packages/better-auth/src/plugins/oidc-provider/types.ts @@ -204,7 +204,10 @@ export interface AuthorizationQuery { /** * The prompt parameter is used to specify the type of user interaction that is required. */ - prompt?: (string & {}) | ("none" | "consent" | "login" | "select_account") | undefined; + prompt?: + | (string & {}) + | ("none" | "consent" | "login" | "select_account") + | undefined; /** * The display parameter is used to specify how the authorization server displays the * authentication and consent user interface pages to the end user. @@ -354,13 +357,13 @@ export interface CodeVerificationValue { * with the actual code. */ requireConsent: boolean; - /** - * Whether the user needs to be logged in to use the client. - * - * If this is true, then the user will be redirected to the login page. - * If the user is already logged in, they will be redirected to the redirect URI. - */ - requireLogin: boolean; + /** + * Whether the user needs to be logged in to use the client. + * + * If this is true, then the user will be redirected to the login page. + * If the user is already logged in, they will be redirected to the redirect URI. + */ + requireLogin: boolean; /** * The state parameter from the request *