From 496be4112446c2369c7be1ff36f60c3f485f2794 Mon Sep 17 00:00:00 2001
From: Guilhem Lemouel <guilhemlemouel@gmail.com>
Date: Fri, 4 Sep 2026 18:05:25 +0200
Subject: [PATCH] fix(oauth): make the account chooser the default, not the
 opt-in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The login page now flags only the `auto_login_provider` redirect, with
`auto=true`; every other login — a click on a provider button, or the
endpoint opened as a plain URL — gets the provider's extra params.

`/api/oauth/login/*` is whitelisted in `public_app_layer` and reachable
directly, so an opt-in flag would silently drop the account chooser for
every caller that is not our own button.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH
---
 backend/ee-repo-ref.txt                  |  2 +-
 frontend/src/lib/components/Login.svelte | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index e718b67f0e..bfd5691900 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-05512fd5ac1e4ff9226cec2dc84799a117ade2dc
+5684bb0f63dce08d6ce9ab0183072c8b4fce4b2e
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index 4b1ca471fb..3b6496c43a 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -400,7 +400,7 @@
 				if (!redirectSaml()) autoRedirecting = false
 			} else if (logins?.some((l) => l.type === autoLogin)) {
 				autoRedirecting = true
-				if (!storeRedirect(autoLogin, false)) {
+				if (!storeRedirect(autoLogin, true)) {
 					autoRedirecting = false
 					sendUserToast('Popup blocked — please click the sign-in button to continue.', true)
 				}
@@ -534,17 +534,17 @@
 		}
 	}
 
-	// `userInitiated` tells the backend the user picked this provider themselves, which is
-	// what makes Google and Microsoft show their account chooser. Auto-login passes false
-	// so its redirect stays a silent bounce.
-	function storeRedirect(provider: string, userInitiated: boolean): boolean {
+	// `automatic` marks the auto-login redirect, the one login that has to reach the
+	// provider without drawing anything. It suppresses the provider's extra params —
+	// Google's and Microsoft's account chooser — which every other login gets.
+	function storeRedirect(provider: string, automatic: boolean): boolean {
 		// The kitchen sink renders real provider buttons; clicking one must not leave the page.
 		if (previewConfig) return true
 		markLoginMethodPending({ kind: 'oauth', provider })
 		persistRd()
 		const params = new URLSearchParams()
 		if (popup) params.set('close', 'true')
-		if (userInitiated) params.set('user_initiated', 'true')
+		if (automatic) params.set('auto', 'true')
 		const query = params.toString()
 		let url = base + '/api/oauth/login/' + provider + (query ? '?' + query : '')
 		console.log('storeRedirect', popup, url)
@@ -686,7 +686,7 @@
 						onClick={() =>
 							entry.method.kind === 'saml'
 								? redirectSaml()
-								: storeRedirect(entry.method.provider, true)}
+								: storeRedirect(entry.method.provider, false)}
 					>
 						Continue with {entry.displayName}
 					</Button>