feat: add prompt and hint options to AuthClient - #145
Open
sea-snake wants to merge 1 commit into
Open
Conversation
Two optional constructor options that shape the authorize URL, for silent re-authentication against Internet Identity: - `prompt: 'none'` asks II to answer from a delegation it already holds and return without rendering anything (or fail with interaction_required), rather than running a ceremony. Omitting it (or 'login') signs in normally. - `hint` is the Principal to re-issue for, so II can pick which stored delegation a prompt=none request resolves to. Both are II-specific extensions inspired by OpenID Connect's prompt/login_hint, so they travel as query params on the authorize URL rather than in the ICRC request. Baking them into the URL at construction means one client per authorize intent; clients share storage, so whichever flow resolves populates the session. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR extends AuthClient configuration to support Internet Identity–specific authorize URL query parameters for non-interactive flows and delegation re-issue targeting.
Changes:
- Add
promptoption ('none' | 'login') to append apromptquery param to the identity provider authorize URL. - Add
hint: Principaloption to append ahintquery param (principal text) to the authorize URL. - Add unit tests validating
prompt/hintURL parameter behavior and their absence when unset.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| tests/client/auth-client.test.ts | Adds coverage to ensure prompt and hint are correctly propagated into the transport URL and omitted by default. |
| src/client/auth-client.ts | Introduces prompt/hint options on AuthClientCreateOptions and bakes them into the constructed identity provider authorize URL. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two optional
AuthClientconstructor options for silent re-authentication against Internet Identity:prompt: 'none'asks II to answer from a delegation it already holds for this app and return without rendering anything (or fail withinteraction_required), instead of running a ceremony. Omitting it, or'login', signs in normally.hint(aPrincipal) names which stored delegation aprompt: 'none'request should re-issue when the user has more than one for the app.Both are II-specific extensions inspired by OpenID Connect's
prompt/login_hint, so they travel as query params on the authorize URL rather than in the ICRC request. They are baked into the URL at construction (likeopenIdProvider), so a client is configured for one authorize intent; construct a separate client for a silent re-issue vs an interactive sign-in, and since they share storage, whichever resolves populates the session.First of a 3-PR stack toward shared sessions across sibling subdomains.