binarybeachio: account chooser, brand logo, session convention

Three small fork tweaks bundled together; none touch upload flow:

* OIDC: pass `prompt=select_account` so Zitadel always shows its account
  picker rather than silently passing through an existing session. Override
  with OIDC_PROMPT env var.
* Branding: swap "with binarybeach.io" -> "with BinaryBeach.io" and replace
  GitHub light/dark logo imports with our brand mark (works on both themes).
* Session: thread the binarybeachio session-lifecycle convention values
  (SESSION_COOKIE_AGE, ADMIN_SESSION_COOKIE_AGE, SESSION_SAVE_EVERY_REQUEST)
  through docker-compose.bb-local.yml app-env mixin and document the
  cross-fork convention link in BINARYBEACHIO.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
binarybeach 2026-04-30 14:51:21 -10:00
parent 46440c2720
commit 7c21b985d9
5 changed files with 27 additions and 11 deletions

View file

@ -111,8 +111,19 @@ class GitHubOAuthProvider(OauthAdapter):
"state": state,
}
# OIDC requires response_type=code; GitHub OAuth tolerates it.
# `prompt=select_account` makes Zitadel show its account chooser even
# when only one session exists — the user explicitly chooses which
# identity to use rather than being silently passed through. Without
# this, the OIDC default is "session exists → log in immediately,"
# which is technically correct SSO but is an unfamiliar UX coming
# from Google/GitHub style flows that always show a picker.
# Override per-request by setting `OIDC_PROMPT=` (empty) or another
# value (`login` to force re-auth, `consent` to force consent screen).
if os.environ.get("ZITADEL_DOMAIN"):
url_params["response_type"] = "code"
prompt = os.environ.get("OIDC_PROMPT", "select_account")
if prompt:
url_params["prompt"] = prompt
auth_url = f"{self._auth_url_base}?{urlencode(url_params)}"
super().__init__(
request,