[v1rusnl]

Request login consent when adding an OIDC account with the offline_access scope, ensuring consent is requested while preserving reauthentication.

Other login flows, configured prompts, PKCE, and token handling remain unchanged. Adds three passing tests covering prompt selection and URL encoding.

Fixes #243

[guruz]

Thank you for the PR and analysis.
It seems to be hard to get it right for all IDPs. The prompt value was only recently changed (for iOS/Android) because one IDP didn't support multiple values in the prompt field.

(Side note: The desktop client is using "consent" as a fallback prompt value when the server's prompt_values_supported are not returned. Android client does not parse prompt_values_supported)
ref https://github.com/opencloud-eu/desktop/blob/5ce0c6618472bc92dcfa0973bcc907d7aed4d1bf/src/libsync/creds/oauth.cpp#L677

What does VoidAuth's prompt_values_supported return?

According to your analysis, just using "consent" also gives you what you want? I'm tempted to say as a quick fix the default should just be switched to that, to align with desktop client?

CC @TheOneRing

[v1rusnl]

Thanks for the feedback! That's the explanation that it worked when I worte the Guide https://voidauth.app/#/OIDC-Guides?id=-opencloud und then stopped 😄

VoidAuth's prompt_values_supported

VoidAuth v1.16.0 does not advertise prompt_values_supported in its OIDC discovery metadata.

Verified with:

curl -fsS 'https://<voidauth-host>/oidc/.well-known/openid-configuration' \
  | jq 'has("prompt_values_supported")'

Result:

false

prompt=consent works — also verified on Android!

I previously tested all three prompt values with the OpenCloudAndroid client:

Prompt	Refresh token issued
login	No
consent	Yes
login consent	Yes

Following your suggestion, I have now changed the Android source code to use only prompt=consent, rebuilt the QA APK, and tested it on my physical Android device.

The modified app successfully completes the OIDC login

If the user is not already authenticated with VoidAuth in the browser, VoidAuth automatically presents the login page. Therefore, explicitly requesting prompt=login is not necessary for normal authenticationin VoidAuth.

Conclusion

I agree that switching the default to consent is a better solution, especially for compatibility with IDPs that do not support multiple prompt values.

It also aligns Android with the desktop client's fallback behavior when prompt_values_supported is absent.

I'm happy to update PR #244 accordingly.

Thanks again for your feedback!