Add support for OIDC-compliant param to trigger signup flow

[DanielBrierton]

Important

Why are we doing this?

We're in the process of rebuilding profile into a Rails app and are making an attempt to better align with OIDC standards. While rpf-accounts will support login_options=force_signup, it will be deprecated in favour of the OIDC-compliant prompt=create

What we need to do

There are multiple ways we could tackle this

Add a setup lambda to the omniauth_openid_connect config

• Add a setup lambda to openid_connect_options in lib/rpi_auth/engine.rb
  • Check for presence of prompt request param
  • If param is present, update strategy options to set prompt to provided value
  • See sample code in references section

Allow prompt as an authorize param

We need to test if this will work, since prompt is a specially handled param by omniauth_openid_connect

• Update allow_authorize_params in lib/rpi_auth/engine.rb to include :prompt

Add a second provider explicitly for sign up

• Update lib/rpi_auth/engine.rb to provision a second provider for rpi_signup
  • Apps would then just hit /auth/rpi_signup rather than having to set the prompt param

Common tasks regardless of approach

• Update docs to include information on how to force signup using the prompt, and the deprecation of force_signup
  • README.md in this repo
  • documentation repo
• Bump minor version as this is a non-breaking change
• Write tests
• Release new version
• Communicate change to teams

Acceptance criteria

Feature: …
As a …
I want to …
So that ….

Scenario: …

Given I provide prompt=create to the auth route provided by rpi_auth
When I am redirected to rpf-accounts
Then I am shown the sign up page rather than the log in page

References

setup lambda

Note

This code was generated by Claude and not verified. It should be reviewed and tested before use

setup: lambda do |env|
  request = Rack::Request.new(env)
  strategy = env['omniauth.strategy']

  if request.params['prompt'].present?
    # Depending on your gem version this key may be
    # `extra_authorize_params` or `authorize_params` — see note below.
    strategy.options[:extra_authorize_params] ||= {}
    strategy.options[:extra_authorize_params][:prompt] = request.params['prompt']
  end
end,

Notes

Open questions

• Which option do we go with?