feat(credentials): let users choose the account for interactive login (DM-3512) - #2730
feat(credentials): let users choose the account for interactive login (DM-3512)#2730yangru96 wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for prompt and login_hint parameters to the interactive OAuth flow in OAuthInteractive and default_oauth_interactive across sync and async clients, enabling explicit account selection and login hints. Feedback was provided to use credentials.get("id_token_claims") or {} to defensively handle cases where the claims key exists but is None.
There was a problem hiding this comment.
I am a bit sceptical to the real value of several of these tests (and existing tbh).
To what extent have you tested this new logic yourself? Especially with the caching it is super easy to screw something up (speaking from experience here 😅 )
There was a problem hiding this comment.
Fair. The reason I'd keep them is that the logic branches on three things at once: how many accounts are cached (none / one / several), whether prompt was passed, and whether we already signed in this session. The "several accounts" branch also needs a second real account, so it's hard to hit by hand.
I just tested it for real though: a temp script running locally against the "quick start sdk" app registration in Azure (Graph as the scope), with a real on-disk cache and a fresh provider each step.
- Fresh cache, no args — browser opens, no picker.
- Run again, no args — no browser, cached account reused.
- login_hint for that same account — no browser, reused silently.
- login_hint for an account I've never used — browser opens with login_hint=... in the authorize URL; whether Entra pre-fills it or shows the picker depends on what sessions the browser already has.
- prompt="select_account" — picker appears even though I'd signed in.
All as expected.
haakonvt
changed the title
OAuthInteractive silently used the first account it found in the token cache, so users signed in with several accounts had no way to choose and often ended up on the wrong one. Add prompt and login_hint to OAuthInteractive, its default_for_entra_id helper, (Async)CogniteClient.default_oauth_interactive and the YAML/JSON config accepted by load(). Pass prompt="select_account" to pick the account in the browser, or login_hint to name it up front and skip being asked. Once signed in, later token refreshes stay on that account without prompting again. Behavior change: when the token cache holds several accounts and neither argument is given, the browser now opens with an account picker instead of silently using an arbitrary account. A single cached account is still reused silently, so users with one account are unaffected.
584a645 to
b0e826a
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2730 +/- ##
==========================================
+ Coverage 93.70% 93.73% +0.02%
==========================================
Files 504 505 +1
Lines 51112 51437 +325
==========================================
+ Hits 47897 48212 +315
- Misses 3215 3225 +10
🚀 New features to boost your workflow:
|
2 participants
Description
OAuthInteractive silently used the first account it found in the token cache, so users signed in with several accounts had no way to choose and often ended up on the wrong one.
Add
promptandlogin_hintto OAuthInteractive, itsdefault_for_entra_idhelper,(Async)CogniteClient.default_oauth_interactiveand the YAML/JSON config accepted byload(). Passprompt="select_account"to pick the account in the browser, orlogin_hintto name it up front and skip being asked. Once signed in, later token refreshes stay on that account without prompting again.Behavior change: when the token cache holds several accounts and neither argument is given, the browser now opens with an account picker instead of silently using an arbitrary account. A single cached account is still reused silently, so users with one account are unaffected.
Checklist: