Repository navigation
Force Auth0 login prompt for account-linking's second identity - #67
Merged
Merged
Conversation
linkStart's authorizeURL call never passed prompt=login, so a visitor with an active Auth0 SSO session (from their first identity) got silently re-authenticated as that same identity and bounced straight back through link/callback - no chance to enter a different account's credentials. Add prompt= support to authorizeURL and pass prompt=login specifically for the link flow; the normal /auth/login path is unaffected (no prompt argument passed there).
LinkStartTests, UsersAPIClientLinkCompleteTests, and ProvisionedUserIDTests each mutated the process-global USERS_API_URL env var via setenv/unsetenv, each marked .serialized - but .serialized only orders tests within one suite, not across suites, so Swift Testing's cross-suite parallelism raced them against each other. One suite's fake-server URL could leak into another suite's in-flight request mid-test. Observed in CI as PR #67's 'a users-api link/start failure surfaces as a 503' test getting a spurious 404 instead - the request landed on a different suite's fake server, which had no matching route for /internal/identities/link/start. Merging the three suites into one .serialized suite makes all tests that share this mutable state truly serialize against each other. Verified by running the full suite 3x locally with no failures (previously flaky).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
linkStart'sauthorizeURLcall never passedprompt=login. A visitor who already has anactive Auth0 SSO session (from their first identity) got silently re-authenticated as that
same identity and bounced straight back through
/auth/link/callback- no chance to enter adifferent account's credentials, which from the UI looked like "click link, page loads and
comes back immediately."
Added
promptsupport toAuth0Config.authorizeURLand passprompt=loginspecifically fromlinkStart, forcing Auth0's credentials screen even with an active SSO session. The normal/auth/loginpath is unaffected - nopromptargument passed there, same behavior as before.Found while testing
link-user-accounts(sweetrpg/platform#70) on dev, after a separateAuth0 Allowed Callback URLs config fix.
Test plan
swift build- cleanswift test(full suite, 25/25) - passswift format lint --recursive --strict Sources Tests- cleaninstead of silently completing with the same identity