feat(server): add configurable OAuth prompt parameter (#26755)

* feat(server): add configurable OAuth prompt parameter

Add a `prompt` field to the OAuth system config, allowing admins to
configure the OIDC `prompt` parameter (e.g. `select_account`, `login`,
`consent`). Defaults to empty string (no prompt sent), preserving
backward compatibility.

This is useful for providers like Google where users want to be prompted
to select an account when multiple accounts are signed in.

Discussed in #20762

* chore: regenerate OpenAPI spec and clients for OAuth prompt field

* Adding e2e test cases

* feat: web setting

* feat: docs

---------

Co-authored-by: Jason Rasmussen <jason@rasm.me>

server/src/config.ts

@@ -106,6 +106,7 @@ export type SystemConfig = {
     issuerUrl: string;
     mobileOverrideEnabled: boolean;
     mobileRedirectUri: string;
+    prompt: string;
     scope: string;
     signingAlgorithm: string;
     profileSigningAlgorithm: string;
@@ -298,6 +299,7 @@ export const defaults = Object.freeze<SystemConfig>({
     issuerUrl: '',
     mobileOverrideEnabled: false,
     mobileRedirectUri: '',
+    prompt: '',
     scope: 'openid email profile',
     signingAlgorithm: 'RS256',
     profileSigningAlgorithm: 'none',

server/src/dtos/system-config.dto.ts

@@ -189,6 +189,7 @@ const SystemConfigOAuthSchema = z
       })
       .describe('Issuer URL'),
     scope: z.string().describe('Scope'),
+    prompt: z.string().describe('OAuth prompt parameter (e.g. select_account, login, consent)'),
     signingAlgorithm: z.string().describe('Signing algorithm'),
     profileSigningAlgorithm: z.string().describe('Profile signing algorithm'),
     storageLabelClaim: z.string().describe('Storage label claim'),

server/src/repositories/oauth.repository.ts

@@ -25,6 +25,7 @@ export type OAuthConfig = {
   mobileOverrideEnabled: boolean;
   mobileRedirectUri: string;
   profileSigningAlgorithm: string;
+  prompt: string;
   scope: string;
   signingAlgorithm: string;
   tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
@@ -57,6 +58,10 @@ export class OAuthRepository {
       state,
     };
 
+    if (config.prompt) {
+      params.prompt = config.prompt;
+    }
+
     if (client.serverMetadata().supportsPKCE()) {
       params.code_challenge = codeChallenge;
       params.code_challenge_method = 'S256';

server/src/services/auth.service.spec.ts

@@ -964,7 +964,7 @@ describe(AuthService.name, () => {
       const profile = OAuthProfileFactory.create({ picture: 'https://auth.immich.cloud/profiles/1.jpg' });
 
       mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
-      mocks.oauth.getProfile.mockResolvedValue(profile);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
       mocks.user.getByOAuthId.mockResolvedValue(user);
       mocks.oauth.getProfilePicture.mockResolvedValue({
         contentType: 'text/html',

server/src/services/system-config.service.spec.ts

@@ -140,6 +140,7 @@ const updatedConfig = Object.freeze<SystemConfig>({
     issuerUrl: '',
     mobileOverrideEnabled: false,
     mobileRedirectUri: '',
+    prompt: '',
     scope: 'openid email profile',
     signingAlgorithm: 'RS256',
     profileSigningAlgorithm: 'none',