starred/windmill

Fork 0

mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-08 08:04:25 +00:00

Files

T

History

9f7908e262 fix(oauth): show the account chooser on an explicit Google/Microsoft login (#10961 )

* fix(oauth): show the account chooser on Google/Microsoft login

Without `prompt=select_account`, Google and Microsoft silently reuse the single
active browser session, so a user with more than one account has no way to pick
which one to sign in with.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH

* chore: pin ee ref for the oauth login extra_params fix

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH

* fix(oauth): only ask for the account chooser on an explicit login click

The login page now sends `user_initiated=true` when someone clicks a
provider button, and the backend applies the provider's `extra_params`
only for those requests.

Someone whose browser holds a single Google session whose email is
already registered under a different login type hits
"an user with the email associated to this login exists but with a
different login type" and, with no account chooser, has no way to offer
a different account. The chooser belongs on that click.

It does not belong on the `auto_login_provider` redirect, whose whole
purpose is to sign a public-app or approval-page visitor in without
interaction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH

* fix(oauth): make the account chooser the default, not the opt-in

The login page now flags only the `auto_login_provider` redirect, with
`auto=true`; every other login — a click on a provider button, or the
endpoint opened as a plain URL — gets the provider's extra params.

`/api/oauth/login/*` is whitelisted in `public_app_layer` and reachable
directly, so an opt-in flag would silently drop the account chooser for
every caller that is not our own button.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0196aV8v36ukoQcD7L2scvmH

* chore: update ee-repo-ref to f5d6b6b8dd00b0141308337ac97f4685781f2b1c

This commit updates the EE repository reference after PR #776 was merged in windmill-ee-private.

Previous ee-repo-ref: 5684bb0f63dce08d6ce9ab0183072c8b4fce4b2e

New ee-repo-ref: f5d6b6b8dd00b0141308337ac97f4685781f2b1c

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>