dev/core#2141 - Set prompt=select_account whenever using MailSetup

If you're an admin setting up an email return-channel, then you may not
intend to use your normal email account.  It makes sense to always prompt
for the preferred account.

diff --git a/ext/oauth-client/CRM/OAuth/MailSetup.php b/ext/oauth-client/CRM/OAuth/MailSetup.php
index d12a03a5d07a76b81113c5d936195b8a43f241ef..2ed9c0175128177d9b0b654fa49451f369f2a309 100644 (file)
--- a/ext/oauth-client/CRM/OAuth/MailSetup.php
+++ b/ext/oauth-client/CRM/OAuth/MailSetup.php
@@ -46,6 +46,7 @@ class CRM_OAuth_MailSetup {
       ->addWhere('id', '=', $setupAction['oauth_client_id'])
       ->setStorage('OAuthSysToken')
       ->setTag('MailSettings:setup')
+      ->setPrompt('select_account')
       ->execute()
       ->single();
 

diff --git a/ext/oauth-client/Civi/Api4/Action/OAuthClient/AuthorizationCode.php b/ext/oauth-client/Civi/Api4/Action/OAuthClient/AuthorizationCode.php
index 3868973be0d978e5281df27c1cd6c18ad2b71a43..8accac29c13a5bfe1f3d3378d37b0647d78dd75a 100644 (file)
--- a/ext/oauth-client/Civi/Api4/Action/OAuthClient/AuthorizationCode.php
+++ b/ext/oauth-client/Civi/Api4/Action/OAuthClient/AuthorizationCode.php
@@ -24,6 +24,8 @@ use Civi\Api4\Generic\Result;
  *
  * @method $this setLandingUrl(string $landingUrl)
  * @method string getLandingUrl()
+ * @method $this setPrompt(string $prompt)
+ * @method string getPrompt()
  *
  * @link https://tools.ietf.org/html/rfc6749#section-4.1
  */
@@ -39,6 +41,15 @@ class AuthorizationCode extends AbstractGrantAction {
    */
   protected $landingUrl = NULL;
 
+  /**
+   * @var string
+   *   Ex: 'none', 'consent', 'select_account'
+   *
+   * @see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
+   * @see https://developers.google.com/identity/protocols/oauth2/web-server
+   */
+  protected $prompt = NULL;
+
   /**
    * Tee-up the authorization request.
    *
@@ -63,11 +74,15 @@ class AuthorizationCode extends AbstractGrantAction {
       'scopes' => $scopes,
       'tag' => $this->getTag(),
     ]);
+    $authOptions = [
+      'state' => $stateId,
+      'scope' => $scopes,
+    ];
+    if ($this->prompt !== NULL) {
+      $authOptions['prompt'] = $this->prompt;
+    }
     $result[] = [
-      'url' => $provider->getAuthorizationUrl([
-        'state' => $stateId,
-        'scope' => $scopes,
-      ]),
+      'url' => $provider->getAuthorizationUrl($authOptions),
     ];
   }
 

diff --git a/ext/oauth-client/Civi/OAuth/CiviGenericProvider.php b/ext/oauth-client/Civi/OAuth/CiviGenericProvider.php
index 03969977be49bf829f21081b2a1310e93816b2b4..677c21d6fd8ea014a8b27b2f6b75542223f829fe 100644 (file)
--- a/ext/oauth-client/Civi/OAuth/CiviGenericProvider.php
+++ b/ext/oauth-client/Civi/OAuth/CiviGenericProvider.php
@@ -3,4 +3,14 @@ namespace Civi\OAuth;
 
 class CiviGenericProvider extends \League\OAuth2\Client\Provider\GenericProvider {
 
+  protected function getAuthorizationParameters(array $options) {
+    $newOptions = parent::getAuthorizationParameters($options);
+    if (!isset($options['approval_prompt'])) {
+      // GenericProvider insists on filling in "approval_prompt", but this seems
+      // to be disfavored nowadays b/c OpenID Connect defines "prompt".
+      unset($newOptions['approval_prompt']);
+    }
+    return $newOptions;
+  }
+
 }