Merge pull request #183 from nov/fix/double_render_on_prompt_consent

stop render consent screen when user is not logged-in

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Unreleased
 
 - [#PR ID] Add your changelog entry here.
+- [#183] stop render consent screen when user is not logged-in
 
 ## v1.8.3 (2022-12-02)
 

lib/doorkeeper/openid_connect/helpers/controller.rb

@@ -76,7 +76,7 @@ def handle_oidc_prompt_param!(owner)
             when 'login'
               reauthenticate_oidc_resource_owner(owner) if owner
             when 'consent'
-              render :new
+              render :new if owner
             when 'select_account'
               select_account_for_oidc_resource_owner(owner)
             else

spec/controllers/doorkeeper/authorizations_controller_spec.rb

@@ -262,6 +262,12 @@ def expect_successful_callback!
     end
 
     context 'with a prompt=consent parameter' do
+      it 'redirects to the sign in form if not logged in' do
+        authorize! prompt: 'consent', current_user: nil
+
+        expect(response).to redirect_to('/login')
+      end
+
       it 'renders the authorization form even if a matching token is present' do
         create :access_token, token_attributes
         authorize! prompt: 'consent'