feat: do not show oidc consent screen every time

frontend/src/pages/authorize-page.tsx

@@ -190,8 +190,7 @@ export const AuthorizePage = () => {
       <CardFooter className="flex flex-col items-stretch gap-3">
         <Button
           onClick={() => authorizeMutate()}
-          loading={authorizePending}
-          disabled={shouldAutoAuthorize}
+          loading={authorizePending || shouldAutoAuthorize}
         >
           {t("authorizeTitle")}
         </Button>

internal/assets/migrations/postgres/000003_oidc_consent.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS "oidc_consents";

internal/assets/migrations/postgres/000003_oidc_consent.up.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" BIGINT NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);

internal/assets/migrations/sqlite/000011_oidc_consent.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS "oidc_consents";

internal/assets/migrations/sqlite/000011_oidc_consent.up.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" INTEGER NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);

internal/bootstrap/app_bootstrap.go

@@ -179,8 +179,6 @@ func (app *BootstrapApp) Setup() error {
 	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
 
 	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
-	app.runtime.CSRFCookieName = fmt.Sprintf("%s-%s", model.CSRFCookieName, cookieId)
-	app.runtime.RedirectCookieName = fmt.Sprintf("%s-%s", model.RedirectCookieName, cookieId)
 	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
 
 	// database

internal/controller/oidc_controller.go

@@ -242,6 +242,16 @@ func (controller *OIDCController) authorize(c *gin.Context) {
 		}
 	}
 
+	if userContext != nil && userContext.Authenticated && values.OIDCPrompt != service.OIDCPromptLogin {
+		consent, err := controller.oidc.GetOIDCConsent(c, userContext.GetUsername(), req.ClientID)
+
+		if err != nil {
+			controller.log.App.Warn().Err(err).Msg("Failed to get OIDC consent")
+		} else if consent != nil && scopesGranted(consent.Scope, req.Scope) {
+			values.OIDCPrompt = service.OIDCPromptNone
+		}
+	}
+
 	queries, err := query.Values(values)
 
 	if err != nil {
@@ -320,6 +330,19 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
+	// Get the client
+	client, ok := controller.oidc.GetClient(authorizeReq.ClientID)
+
+	if !ok {
+		controller.authorizeError(c, authorizeErrorParams{
+			err:          errors.New("client not found"),
+			reason:       "Client not found",
+			reasonPublic: "The client is not configured",
+			json:         true,
+		})
+		return
+	}
+
 	// We no longer need the ticket
 	controller.oidc.DeleteAuthorizeRequestTicket(req.Ticket)
 
@@ -356,6 +379,11 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
+	// Store the consent granted by the user for this client
+	if _, err := controller.oidc.UpsertOIDCConsent(c, userContext.GetUsername(), authorizeReq.Scope, client.ClientID); err != nil {
+		controller.log.App.Warn().Err(err).Msg("Failed to store OIDC consent")
+	}
+
 	q := cu.Query()
 
 	q.Set("code", code)
@@ -756,3 +784,20 @@ func (controller *OIDCController) resolveNormalParams(c *gin.Context) (*service.
 
 	return &req, nil
 }
+
+// scopesGranted reports whether every scope in requested is present in the
+// space-separated granted scope string.
+func scopesGranted(granted, requested string) bool {
+	grantedScopes := strings.Split(granted, " ")
+
+	for _, scope := range strings.Split(requested, " ") {
+		if scope == "" {
+			continue
+		}
+		if !slices.Contains(grantedScopes, scope) {
+			return false
+		}
+	}
+
+	return true
+}

internal/controller/oidc_controller_test.go

@@ -170,6 +170,102 @@ func TestOIDCController(t *testing.T) {
 				assert.Contains(t, location, "oidc_name="+url.QueryEscape("Test Client"))
 			},
 		},
+		{
+			description: "Authorize skips the consent screen when all requested scopes were already granted",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid profile", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when a new scope is requested",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.NotContains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize skips the consent screen for a subset of already granted scopes",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid profile email", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when no consent was granted yet",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.NotContains(t, location, "oidc_prompt=none")
+			},
+		},
 		{
 			description: "Authorize redirects to error screen when the request object is invalid",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {

internal/model/constants.go

@@ -20,8 +20,6 @@ var OverrideProviders = map[string]string{
 var ReservedProviderNames = []string{"local", "ldap", "tailscale"}
 
 const SessionCookieName = "tinyauth-session"
-const CSRFCookieName = "tinyauth-csrf"
-const RedirectCookieName = "tinyauth-redirect"
 const OAuthSessionCookieName = "tinyauth-oauth"
 
 const GracefulShutdownTimeout = 5 // seconds

internal/model/runtime.go

@@ -5,8 +5,6 @@ type RuntimeConfig struct {
 	UUID                     string
 	CookieDomain             string
 	SessionCookieName        string
-	CSRFCookieName           string
-	RedirectCookieName       string
 	OAuthSessionCookieName   string
 	LocalUsers               []LocalUser
 	OAuthProviders           map[string]OAuthServiceConfig

internal/repository/memory/memory_test.go

@@ -277,6 +277,80 @@ func TestMemoryStore(t *testing.T) {
 				assert.NoError(t, err)
 			},
 		},
+		{
+			description: "Upsert creates a consent for each user+client pair",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid profile", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-b", Scope: "openid email", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 2)
+
+				gotA, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid profile", gotA.Scope)
+
+				gotB, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-b"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid email", gotB.Scope)
+			},
+		},
+		{
+			description: "Upsert overwrites the same consent row",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid email", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 1)
+
+				got, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid email", got.Scope)
+			},
+		},
+		{
+			description: "Get consent by username and client not found",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				assert.ErrorIs(t, err, repository.ErrNotFound)
+			},
+		},
+		{
+			description: "Delete consent by client id",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-b", Scope: "openid", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				require.NoError(t, s.DeleteOIDCConsentByClientID(ctx, "client-a"))
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 1)
+				assert.Equal(t, "client-b", consents[0].ClientID)
+			},
+		},
 	}
 
 	for _, test := range tests {

internal/repository/memory/oidc_queries.go

@@ -94,3 +94,46 @@ func (s *Store) DeleteExpiredOIDCSessions(_ context.Context, arg repository.Dele
 	}
 	return nil
 }
+
+func consentKey(username, clientID string) string {
+	return username + "\x00" + clientID
+}
+
+func (s *Store) UpsertOIDCConsent(_ context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	oc := repository.OidcConsent(arg)
+	s.oidcConsents[consentKey(arg.Username, arg.ClientID)] = oc
+	return oc, nil
+}
+
+func (s *Store) GetOIDCConsentByUsernameAndClientID(_ context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	oc, ok := s.oidcConsents[consentKey(arg.Username, arg.ClientID)]
+	if !ok {
+		return repository.OidcConsent{}, repository.ErrNotFound
+	}
+	return oc, nil
+}
+
+func (s *Store) DeleteOIDCConsentByClientID(_ context.Context, clientID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for key, oc := range s.oidcConsents {
+		if oc.ClientID == clientID {
+			delete(s.oidcConsents, key)
+		}
+	}
+	return nil
+}
+
+func (s *Store) ListOIDCConsents(_ context.Context) ([]repository.OidcConsent, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	out := make([]repository.OidcConsent, 0, len(s.oidcConsents))
+	for _, oc := range s.oidcConsents {
+		out = append(out, oc)
+	}
+	return out, nil
+}

internal/repository/memory/store.go

@@ -12,12 +12,14 @@ type Store struct {
 	mu           sync.RWMutex
 	sessions     map[string]repository.Session
 	oidcSessions map[string]repository.OidcSession
+	oidcConsents map[string]repository.OidcConsent
 }
 
 // New returns a new empty in-memory Store.
 func New() repository.Store {
 	return &Store{
 		sessions:     make(map[string]repository.Session),
 		oidcSessions: make(map[string]repository.OidcSession),
+		oidcConsents: make(map[string]repository.OidcConsent),
 	}
 }

internal/repository/models.go

@@ -84,3 +84,22 @@ type DeleteExpiredOIDCSessionsParams struct {
 	TokenExpiresAt        int64
 	RefreshTokenExpiresAt int64
 }
+
+type OidcConsent struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+type UpsertOIDCConsentParams struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+type GetOIDCConsentByUsernameAndClientIDParams struct {
+	Username string
+	ClientID string
+}