fix(auth): force fresh upstream auth on every SSO click

Append prompt=login and max_age=0 to the OIDC authorize URL wrapped in
the source-login next param. Authentik no longer reuses the existing
session cookie on returning external users, so the source-enrollment
flow stops landing on /if/user/ — which only internal users may
access.

Author: quangdangfit

internal/user/port/http/oidc_handlers.go

@@ -95,14 +95,22 @@ func (h *OIDCHandler) SSORedirect(c *gin.Context) {
 	}
 
 	authURL := h.oidc.AuthCodeURL("goshop-state")
-	if _, err := url.Parse(authURL); err != nil {
+	u, err := url.Parse(authURL)
+	if err != nil {
 		apperror.Wrap(apperror.ErrInternal, err).HTTPError(c)
 		return
 	}
+	// Force a fresh authentication round-trip so Authentik never reuses an
+	// existing session cookie. Without this, the source-enrollment flow on a
+	// returning external user lands on /if/user/ (Internal-only) and 403s.
+	q := u.Query()
+	q.Set("prompt", "login")
+	q.Set("max_age", "0")
+	u.RawQuery = q.Encode()
 
 	base := strings.TrimRight(h.cfg.AuthentikAPIBase, "/")
 	target := fmt.Sprintf("%s/source/oauth/login/%s/?next=%s",
-		base, slug, url.QueryEscape(authURL))
+		base, slug, url.QueryEscape(u.String()))
 	c.Redirect(http.StatusFound, target)
 }
 

internal/user/port/http/oidc_handlers_test.go

@@ -95,7 +95,15 @@ func (s *OIDCHandlerTestSuite) TestSSO_ValidProvider_RedirectsToSourceLoginWithN
 		loc, err := url.Parse(w.Header().Get("Location"))
 		s.Require().NoError(err)
 		s.Equal("/source/oauth/login/"+p+"/", loc.Path, "path must target the source login endpoint")
-		s.Equal(authURL, loc.Query().Get("next"), "next must hold the OIDC authorize URL verbatim")
+
+		// next holds the authorize URL with the prompt/max_age params we add
+		// to force a fresh upstream auth round-trip.
+		next, err := url.Parse(loc.Query().Get("next"))
+		s.Require().NoError(err)
+		s.Equal("login", next.Query().Get("prompt"))
+		s.Equal("0", next.Query().Get("max_age"))
+		s.Equal("x", next.Query().Get("client_id"))
+		s.Equal("goshop-state", next.Query().Get("state"))
 	}
 }