From 6858d1fb30fbb2f5d79e345ae96edfc428e80052 Mon Sep 17 00:00:00 2001
From: Guilhem Lemouel <guilhemlemouel@gmail.com>
Date: Thu, 3 Sep 2026 19:28:46 +0200
Subject: [PATCH] fix(oauth): only ask for the account chooser on an explicit
 login click

The login page now sends `user_initiated=true` when someone clicks a
provider button, and the backend applies the provider's `extra_params`
only for those requests.

Someone whose browser holds a single Google session whose email is
already registered under a different login type hits
"an user with the email associated to this login exists but with a
different login type" and, with no account chooser, has no way to offer
a different account. The chooser belongs on that click.

It does not belong on the `auto_login_provider` redirect, whose whole
purpose is to sign a public-app or approval-page visitor in without
interaction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH
---
 backend/ee-repo-ref.txt                  |  2 +-
 frontend/src/lib/components/Login.svelte | 17 +++++++++++++----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 0ed2b5ad4d..3b1e88066e 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6db6307b4507d793628eedce88bbd7c9a66ddd56
+e11dbe96407f2831cfb71ecadad94e38113eb61f
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index 10f996a33f..4b1ca471fb 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -400,7 +400,7 @@
 				if (!redirectSaml()) autoRedirecting = false
 			} else if (logins?.some((l) => l.type === autoLogin)) {
 				autoRedirecting = true
-				if (!storeRedirect(autoLogin)) {
+				if (!storeRedirect(autoLogin, false)) {
 					autoRedirecting = false
 					sendUserToast('Popup blocked — please click the sign-in button to continue.', true)
 				}
@@ -534,12 +534,19 @@
 		}
 	}
 
-	function storeRedirect(provider: string): boolean {
+	// `userInitiated` tells the backend the user picked this provider themselves, which is
+	// what makes Google and Microsoft show their account chooser. Auto-login passes false
+	// so its redirect stays a silent bounce.
+	function storeRedirect(provider: string, userInitiated: boolean): boolean {
 		// The kitchen sink renders real provider buttons; clicking one must not leave the page.
 		if (previewConfig) return true
 		markLoginMethodPending({ kind: 'oauth', provider })
 		persistRd()
-		let url = base + '/api/oauth/login/' + provider + (popup ? '?close=true' : '')
+		const params = new URLSearchParams()
+		if (popup) params.set('close', 'true')
+		if (userInitiated) params.set('user_initiated', 'true')
+		const query = params.toString()
+		let url = base + '/api/oauth/login/' + provider + (query ? '?' + query : '')
 		console.log('storeRedirect', popup, url)
 
 		if (popup) {
@@ -677,7 +684,9 @@
 						unifiedSize="lg"
 						startIcon={entry.icon ? { icon: entry.icon, classes: 'h-4' } : undefined}
 						onClick={() =>
-							entry.method.kind === 'saml' ? redirectSaml() : storeRedirect(entry.method.provider)}
+							entry.method.kind === 'saml'
+								? redirectSaml()
+								: storeRedirect(entry.method.provider, true)}
 					>
 						Continue with {entry.displayName}
 					</Button>