chore(deps): bump the minor-patch group across 1 directory with 7 updates

Bumps the minor-patch group with 7 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.3` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.34.0` |
| [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.101.4` | `5.102.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |
| [eslint](https://github.com/eslint/eslint) | `10.9.0` | `10.9.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.68.0` |



Updates `@tanstack/react-query` from 5.101.4 to 5.102.3
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.3/packages/react-query)

Updates `lucide-react` from 1.33.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)

Updates `@tanstack/eslint-plugin-query` from 5.101.4 to 5.102.3
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/eslint-plugin-query@5.102.3/packages/eslint-plugin-query)

Updates `@types/node` from 26.2.0 to 26.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `eslint` from 10.9.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.9.0...v10.9.1)

Updates `typescript-eslint` from 8.67.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: lucide-react
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@tanstack/eslint-plugin-query"
  dependency-version: 5.102.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

frontend/package.json

@@ -19,14 +19,14 @@
     "@radix-ui/react-separator": "^1.1.15",
     "@radix-ui/react-slot": "^1.3.3",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query": "^5.101.4",
+    "@tanstack/react-query": "^5.102.3",
     "axios": "^1.19.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "i18next": "^26.4.0",
     "i18next-browser-languagedetector": "^8.2.1",
     "i18next-resources-to-backend": "^1.2.3",
-    "lucide-react": "^1.33.0",
+    "lucide-react": "^1.34.0",
     "next-themes": "^0.4.6",
     "radix-ui": "^1.6.7",
     "react": "^19.2.8",
@@ -42,19 +42,19 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@tanstack/eslint-plugin-query": "^5.101.4",
-    "@types/node": "^26.2.0",
+    "@tanstack/eslint-plugin-query": "^5.102.3",
+    "@types/node": "^26.3.0",
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
+    "@types/react-dom": "^19.2.5",
     "@vitejs/plugin-react": "^6.1.0",
-    "eslint": "^10.9.0",
+    "eslint": "^10.9.1",
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.5.4",
     "globals": "^17.11.0",
     "rollup-plugin-visualizer": "^7.1.1",
     "tw-animate-css": "^1.4.0",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.67.0",
+    "typescript-eslint": "^8.68.0",
     "vite": "^8.2.2"
   }
 }

frontend/src/pages/authorize-page.tsx

@@ -1,5 +1,5 @@
 import { useUserContext } from "@/context/user-context";
-import {useMutation} from "@tanstack/react-query";
+import { useMutation } from "@tanstack/react-query";
 import { Navigate, useNavigate } from "react-router";
 import { useLocation } from "react-router";
 import {
@@ -25,8 +25,7 @@ import {
   searchParamsFromObject,
   useScreenParams,
 } from "@/lib/hooks/screen-params";
-import {useEffect, useState} from "react";
-import { z } from "zod";
+import { useEffect } from "react";
 
 type Scope = {
   id: string;
@@ -35,10 +34,6 @@ type Scope = {
   icon: React.ReactNode;
 };
 
-const skipConsentResponseSchema = z.object({
-  skipConsent: z.boolean(),
-})
-
 const scopeMapIconProps = {
   className: "stroke-muted-foreground stroke-[1.75] h-4",
 };
@@ -101,8 +96,14 @@ export const AuthorizePage = () => {
     }
     return "";
   })();
-  const [autoAuthorize, setAutoAuthorize] = useState(false);
-  const [skipConsentChecked, setSkipConsentChecked] = useState(false);
+
+  // TODO: maybe a better way to do this
+  const shouldAutoAuthorize =
+    auth.authenticated &&
+    isOidc &&
+    screenParams.oidc_ticket !== undefined &&
+    screenParams.oidc_scope !== undefined &&
+    screenParams.oidc_prompt === "none";
 
   const { mutate: authorizeMutate, isPending: authorizePending } = useMutation({
     mutationFn: () => {
@@ -125,34 +126,10 @@ export const AuthorizePage = () => {
   });
 
   useEffect(() => {
-    let active = true;
-    const controller = new AbortController();
-
-    const checkSkipConsent = async () => {
-      try {
-        const res = await fetch(
-          `/api/oidc/skip-consent?oidc_ticket=${encodeURIComponent( screenParams.oidc_ticket ?? "")}`,
-          { signal: controller.signal },
-        );
-        if (!res.ok) return;
-        const parsed = skipConsentResponseSchema.safeParse(await res.json());
-        if (!active || !parsed.success || !parsed.data.skipConsent) return;
-        setAutoAuthorize(true);
-        authorizeMutate();
-      } catch {
-        // Fall back to manual consent on any failure (including abort).
-      } finally {
-        if (active) setSkipConsentChecked(true);
-      }
-    };
-
-    checkSkipConsent();
-
-    return () => {
-      active = false;
-      controller.abort();
-    };
-  }, [authorizeMutate,  screenParams.oidc_ticket]);
+    if (shouldAutoAuthorize) {
+      authorizeMutate();
+    }
+  }, [shouldAutoAuthorize, authorizeMutate]);
 
   if (!isOidc || !screenParams.oidc_ticket || !screenParams.oidc_scope) {
     return (
@@ -213,13 +190,13 @@ export const AuthorizePage = () => {
       <CardFooter className="flex flex-col items-stretch gap-3">
         <Button
           onClick={() => authorizeMutate()}
-          loading={authorizePending || autoAuthorize || !skipConsentChecked}
+          loading={authorizePending || shouldAutoAuthorize}
         >
           {t("authorizeTitle")}
         </Button>
         <Button
           onClick={() => navigate(`/logout${compiledParams}`)}
-          disabled={authorizePending || autoAuthorize}
+          disabled={authorizePending || shouldAutoAuthorize}
           variant="outline"
         >
           {t("cancelTitle")}

frontend/vite.config.ts

@@ -9,7 +9,7 @@ export default defineConfig({
   plugins: [react(), tailwindcss(), visualizer()],
   resolve: {
     alias: {
-      "@": path.resolve(import.meta.dirname, "./src"),
+      "@": path.resolve(__dirname, "./src"),
     },
   },
   build: {

internal/controller/controller.go

@@ -18,8 +18,3 @@ type RedirectQuery struct {
 	RedirectURI string           `url:"redirect_uri"`
 	LoginFor    FrontendLoginFor `url:"login_for"`
 }
-
-type SimpleResponse struct {
-	Status  int    `json:"status"`
-	Message string `json:"message"`
-}

internal/controller/oidc_controller.go

@@ -62,19 +62,15 @@ type ErrorScreen struct {
 	Error string `url:"error"`
 }
 
+type ClientRequest struct {
+	ClientID string `uri:"id" binding:"required"`
+}
+
 type ClientCredentials struct {
 	ClientID     string
 	ClientSecret string
 }
 
-type SkipConsentRequest struct {
-	OIDCTicket string `form:"oidc_ticket" binding:"required"`
-}
-
-type SkipConsentResponse struct {
-	SkipConsent bool `json:"skipConsent"`
-}
-
 type AuthorizeScreenParams struct {
 	LoginFor   FrontendLoginFor   `url:"login_for"`
 	OIDCTicket string             `url:"oidc_ticket"`
@@ -109,7 +105,6 @@ func NewOIDCController(i OIDCControllerInput) *OIDCController {
 
 	oidcGroup := i.RouterGroup.Group("/oidc")
 	oidcGroup.POST("/authorize-complete", controller.authorizeComplete)
-	oidcGroup.GET("/skip-consent", controller.skipConsent)
 	oidcGroup.POST("/token", controller.Token)
 	oidcGroup.GET("/userinfo", controller.Userinfo)
 	oidcGroup.POST("/userinfo", controller.Userinfo)
@@ -247,6 +242,16 @@ func (controller *OIDCController) authorize(c *gin.Context) {
 		}
 	}
 
+	if userContext != nil && userContext.Authenticated && values.OIDCPrompt != service.OIDCPromptLogin {
+		consent, err := controller.oidc.GetOIDCConsent(c, userContext.GetUsername(), req.ClientID)
+
+		if err != nil {
+			controller.log.App.Warn().Err(err).Msg("Failed to get OIDC consent")
+		} else if consent != nil && scopesGranted(consent.Scope, req.Scope) {
+			values.OIDCPrompt = service.OIDCPromptNone
+		}
+	}
+
 	queries, err := query.Values(values)
 
 	if err != nil {
@@ -265,90 +270,6 @@ func (controller *OIDCController) authorize(c *gin.Context) {
 	c.Redirect(http.StatusFound, redirectUrl)
 }
 
-func (controller *OIDCController) skipConsent(c *gin.Context) {
-	c.Header("cache-control", "no-store")
-	c.Header("pragma", "no-cache")
-
-	if controller.oidc == nil {
-		c.JSON(500, SimpleResponse{
-			Status:  500,
-			Message: "OIDC not configured",
-		})
-		return
-	}
-
-	userContext, err := new(model.UserContext).NewFromGin(c)
-
-	if err != nil {
-		if !errors.Is(err, model.ErrUserContextNotFound) {
-			controller.log.App.Warn().Err(err).Msg("Failed to get user context")
-		}
-	}
-
-	if err != nil || !userContext.Authenticated {
-		c.JSON(401, SimpleResponse{
-			Status:  401,
-			Message: "User not logged in",
-		})
-		return
-	}
-
-	var req SkipConsentRequest
-
-	err = c.BindQuery(&req)
-
-	if err != nil {
-		c.JSON(400, SimpleResponse{
-			Status:  400,
-			Message: "Bad request",
-		})
-		return
-	}
-
-	controller.log.App.Debug().Interface("req", req).Msg("Received skip consent request")
-
-	authorizeReq, ok := controller.oidc.GetAuthorizeRequestByTicket(req.OIDCTicket)
-
-	if !ok {
-		c.JSON(200, SkipConsentResponse{
-			SkipConsent: false,
-		})
-		return
-	}
-
-	controller.log.App.Debug().Str("client", authorizeReq.ClientID).Str("user", userContext.GetUsername()).Msg("User consented to OIDC")
-
-	if authorizeReq.Prompt == service.OIDCPromptLogin.String() {
-		c.JSON(200, SkipConsentResponse{
-			SkipConsent: false,
-		})
-		return
-	}
-
-	consent, err := controller.oidc.GetOIDCConsent(c, userContext.GetUsername(), authorizeReq.ClientID)
-
-	if err != nil || consent == nil {
-		if err != nil {
-			controller.log.App.Warn().Err(err).Msg("Failed to get OIDC consent")
-		}
-		c.JSON(200, SkipConsentResponse{
-			SkipConsent: false,
-		})
-		return
-	}
-
-	if !scopesGranted(consent.Scope, authorizeReq.Scope) {
-		c.JSON(200, SkipConsentResponse{
-			SkipConsent: false,
-		})
-		return
-	}
-
-	c.JSON(200, SkipConsentResponse{
-		SkipConsent: true,
-	})
-}
-
 // The actual **internal** endpoint that actually creates the code and session.
 // It is called by the frontend after the user has logged in and given consent.
 func (controller *OIDCController) authorizeComplete(c *gin.Context) {
@@ -409,9 +330,6 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
-	// We no longer need the ticket
-	controller.oidc.DeleteAuthorizeRequestTicket(req.Ticket)
-
 	// Get the client
 	client, ok := controller.oidc.GetClient(authorizeReq.ClientID)
 
@@ -425,6 +343,9 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
+	// We no longer need the ticket
+	controller.oidc.DeleteAuthorizeRequestTicket(req.Ticket)
+
 	// Create the sub to find and delete old sessions
 	sub := controller.oidc.CreateSub(*userContext, authorizeReq.ClientID)
 

internal/controller/oidc_controller_test.go

@@ -171,7 +171,7 @@ func TestOIDCController(t *testing.T) {
 			},
 		},
 		{
-			description: "Authorize does not skip the consent screen even when consent was already granted",
+			description: "Authorize skips the consent screen when all requested scopes were already granted",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
@@ -189,9 +189,77 @@ func TestOIDCController(t *testing.T) {
 				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
 				router.ServeHTTP(recorder, req)
 
-				// The consent skip check now happens after auth via the
-				// skip-consent endpoint, so authorize should never set
-				// prompt=none on its own.
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when a new scope is requested",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.NotContains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize skips the consent screen for a subset of already granted scopes",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid profile email", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when no consent was granted yet",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
 				assert.Equal(t, http.StatusFound, recorder.Code)
 				location := recorder.Header().Get("Location")
 				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
@@ -236,232 +304,6 @@ func TestOIDCController(t *testing.T) {
 			},
 		},
 
-		// --- skip-consent ---
-		{
-			description:  "Skip consent returns 500 when OIDC is not configured",
-			oidcDisabled: true,
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusInternalServerError, recorder.Code)
-			},
-		},
-		{
-			description: "Skip consent returns 401 when the user context is missing",
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
-			},
-		},
-		{
-			description: "Skip consent returns 401 when the user is not authenticated",
-			middlewares: []gin.HandlerFunc{
-				func(c *gin.Context) {
-					c.Set("context", &model.UserContext{
-						Authenticated: false,
-						Provider:      model.ProviderLocal,
-						Local: &model.LocalContext{
-							BaseContext: model.BaseContext{Username: "testuser"},
-						},
-					})
-				},
-			},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
-			},
-		},
-		{
-			description: "Skip consent returns 400 when the ticket is missing",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent", nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusBadRequest, recorder.Code)
-			},
-		},
-		{
-			description: "Skip consent returns false when the ticket is unknown",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=nonexistent-ticket", nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.False(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns true when the authorize request has prompt none",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
-					Username: "testuser", ClientID: "some-client-id",
-					Scope: "openid profile", CreatedAt: time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-					Prompt:       "none",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.True(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns false when no consent was granted yet",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.False(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns false when a new scope is requested",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
-					Username: "testuser", ClientID: "some-client-id",
-					Scope: "openid", CreatedAt: time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.False(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns true when all requested scopes were already granted",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
-					Username: "testuser", ClientID: "some-client-id",
-					Scope: "openid profile", CreatedAt: time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.True(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns true for a subset of already granted scopes",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
-					Username: "testuser", ClientID: "some-client-id",
-					Scope: "openid profile email", CreatedAt: time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.True(t, res.SkipConsent)
-			},
-		},
-		{
-			description: "Skip consent returns false when the consent belongs to another user",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
-
-				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
-					Username: "otheruser", ClientID: "some-client-id",
-					Scope: "openid profile", CreatedAt: time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid profile",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res SkipConsentResponse
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				assert.False(t, res.SkipConsent)
-			},
-		},
-
 		// --- authorize-complete ---
 		{
 			description:  "Should fail if oidc is disabled",
@@ -581,60 +423,6 @@ func TestOIDCController(t *testing.T) {
 				assert.Contains(t, redirectURI, "state=state-123")
 			},
 		},
-		{
-			description: "Authorize complete deletes the ticket on success",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid",
-					ResponseType: "code",
-					ClientID:     "some-client-id",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				body, err := json.Marshal(AuthorizeCompleteRequest{Ticket: ticket})
-				require.NoError(t, err)
-
-				req := httptest.NewRequest("POST", "/api/oidc/authorize-complete", strings.NewReader(string(body)))
-				req.Header.Set("Content-Type", "application/json")
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				_, ok := oidcService.GetAuthorizeRequestByTicket(ticket)
-				assert.False(t, ok)
-			},
-		},
-		{
-			description: "Authorize complete deletes the ticket even when the client is unknown",
-			middlewares: []gin.HandlerFunc{authedUser},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
-					Scope:        "openid",
-					ResponseType: "code",
-					ClientID:     "unknown-client",
-					RedirectURI:  "https://test.example.com/callback",
-				})
-
-				body, err := json.Marshal(AuthorizeCompleteRequest{Ticket: ticket})
-				require.NoError(t, err)
-
-				req := httptest.NewRequest("POST", "/api/oidc/authorize-complete", strings.NewReader(string(body)))
-				req.Header.Set("Content-Type", "application/json")
-				router.ServeHTTP(recorder, req)
-
-				assert.Equal(t, http.StatusOK, recorder.Code)
-
-				var res map[string]any
-				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
-				redirectURI, ok := res["redirect_uri"].(string)
-				require.True(t, ok)
-				assert.Contains(t, redirectURI, oidcService.GetIssuer()+"/error")
-
-				_, ok = oidcService.GetAuthorizeRequestByTicket(ticket)
-				assert.False(t, ok)
-			},
-		},
 
 		// --- token ---
 		{

internal/service/oidc_service.go

@@ -53,17 +53,6 @@ const (
 	OIDCPromptNone  OIDCPrompt = "none"
 )
 
-func (p OIDCPrompt) String() string {
-	switch p {
-	case OIDCPromptLogin:
-		return "login"
-	case OIDCPromptNone:
-		return "none"
-	default:
-		return "login"
-	}
-}
-
 var SupportedPrompts = []string{string(OIDCPromptLogin), string(OIDCPromptNone)}
 
 // This is not spec-compliant, the ID token SHOULD NOT contain user info claims but,