Since we force opts.prompt = "none" below the option is retained.

[gdestuynder]

This means if the code is re-called without re-loading opts the call
to authenticate will be done with opts.prompt = "none" again, where
user interaction would be expected.
This happens if opts is declared as a global value in openresty/nginx,
such as by:
init_by_lua_file "/usr/local/openresty/nginx/conf/conf.d/server.lua";
in nginx.conf, where server.lua contains the opts structure.
This happens when the server owner needs a global opts declaration
reachable by all server {} structures in nginx.

[gdestuynder]

Note: I had to drop the test checking that the prompt parameter set in opts is honoured - because we did not in fact honour it in some conditions (the test would not see that), and with this fix, we never honour it.
If we do, it would break functionality - and since opts is not only used as a user parameter but also as a structure to pass data internally, I didn't find another solution that wouldn't require either refactoring a lot of code, or having a function that behaves differently than other functions :(

[zandbelt]

I guess a better approach would be to explicitly pass a prompt parameter into authenticate and openidc_authorize though that changes the function signature and backwards compatibility...?

[bodewig]

with this PR we'd break code that explicitly asks for the prompt parameter when calling authenticate (which is what the test checks ;-). I'd prefer an explicit parameter over silently discarding the options set.

One option not breaking backwards compatibility could be to only add the explicit parameter to openidc_authorize, set it with opts.prompt in most cases and set it to none in the "silently reauthenticate" case without changing opts there at all. That way opts wouldn't get modified by authenticate. Would this work for you @gdestuynder ?

[bodewig]

@gdestuynder bodewig@195c955 is an alternative solution

[zandbelt]

I'd prefer Stefan's approach if acceptable @gdestuynder

[gdestuynder]

@bodewig that sounds alright

[bodewig]

thanks, see #120

[gdestuynder]

hah great thank you!