Prompt parameter customizable and default to None

[rayluo]

This PR will resolve #58

To test this PR, you can install the package by pip install https://github.com/rayluo/identity/archive/refs/heads/customizable-prompt.zip.

CC: @cjknapp12epic

[cjknapp12epic]

This looks good to me. I tested this version with my Flask app and verified that the default behavior, and explicitly setting prompt=None or prompt='select_account' all function as expected.

The only concern I would have is whether more communication is needed about changing the default behavior, in case anyone was relying on the previous behavior but would now need to explicitly set prompt='select_account' to achieve it.

[rayluo]

This looks good to me. I tested this version with my Flask app and verified that the default behavior, and explicitly setting prompt=None or prompt='select_account' all function as expected.

The only concern I would have is whether more communication is needed about changing the default behavior, in case anyone was relying on the previous behavior but would now need to explicitly set prompt='select_account' to achieve it.

Yeah, I know. In your test with prompt=None, will you run into the issue I mentioned in issue #58?

[cjknapp12epic]

I added a logout link to my app and tested it while having prompt=None and with post_logout_view not set (i.e. defaulting to a view decorated with login_required()), and I did get immediately dropped back into the login flow, but it actually presented the select_account behavior (even though prompt=select_account does not appear in the auth URL).

This is probably fine, because if I wanted to log out and didn't have a logged-out view to land on, this prompt probably makes sense to land on.

[rayluo]

During your logout test, were you redirected to the upstream ID provider (i.e. https://login.microsoftonline.com) and did you actually complete the logout there?

If so, then you finished a complete logout including the logout from the ID provider. That's why the subsequent sign-in attempt will still land you on the account picker.

If you (as a developer) purposely chose to skip logging out from the ID provider, then the situation I described in #58 will kick in.

All in all, it seems that the new default prompt=None is fine for most normal end users. I'll see how to add more "communication" into docs and/or release notes.

[cjknapp12epic]

Ah, yes, I did get taken through a complete logout flow from the upstream provider, although I didn't have to click anything to do it.

I agree that this is probably fine if one would have to deliberately circumvent the upstream logout to get into the behavior your described.

[rayluo]

Shipped in Identity 0.11.0