Redirect native-picker click on OIDC provider to /auth/oidc/welcome (fix dead-end) (#266)

Fixes #252

custom_components/auth_oidc/static/injection.js

@@ -1,37 +1,55 @@
 /**
- * hass-oidc-auth - UX script to automatically select the Home Assistant auth provider when the "Login aborted" message is shown.
+ * Frontend helpers for /auth/authorize: auto-select on aborted login,
+ * and route picker clicks on our provider through /auth/oidc/welcome.
  */
 
+const OIDC_PROVIDER_NAME = "OpenID Connect (SSO)"  // matches provider.py CONF_NAME
+const OIDC_WELCOME_PATH = "/auth/oidc/welcome"
+
 let authFlowElement = null
+let pickerIntercepted = false
+
+function interceptPickerRow(authProviderElement) {
+  if (pickerIntercepted) return
+  if (!authProviderElement) return
+  if (!authProviderElement.shadowRoot) {
+    console.warn("[OIDC] ha-pick-auth-provider has no shadowRoot; HA frontend may have changed.")
+    return
+  }
+  const items = authProviderElement.shadowRoot.querySelectorAll('ha-list-item')
+  if (items.length === 0) return  // not yet populated; retry on next mutation
+  for (const item of items) {
+    if ((item.innerText || '').trim() !== OIDC_PROVIDER_NAME) continue
+    item.addEventListener('click', (e) => {
+      e.stopImmediatePropagation()
+      e.preventDefault()
+      window.location.href =
+        OIDC_WELCOME_PATH +
+        '?redirect_uri=' + encodeURIComponent(btoa(window.location.href))
+    }, true)
+    pickerIntercepted = true
+    return
+  }
+}
 
 function update() {
-  // Find ha-auth-flow
-    authFlowElement = document.querySelector('ha-auth-flow');
+  authFlowElement = document.querySelector('ha-auth-flow')
+  if (!authFlowElement) return
 
-    if (!authFlowElement) {
-      return;
-    }
+  const authProviderElement = document.querySelector('ha-pick-auth-provider')
 
-    // Check if the text "Login aborted" is present on the page
-    if (!authFlowElement.innerText.includes('Login aborted')) {
-      return;
-    }
+  // Intercept picker clicks so the OIDC cookie is set before submit.
+  interceptPickerRow(authProviderElement)
 
-    // Find the ha-pick-auth-provider element
-    const authProviderElement = document.querySelector('ha-pick-auth-provider');
-
-    if (!authProviderElement) {
-      return;
-    }
-
-    // Click the first ha-list-item element inside the ha-pick-auth-provider
-    const firstListItem = authProviderElement.shadowRoot?.querySelector('ha-list-item');
-    if (!firstListItem) {
-      console.warn("[OIDC] No ha-list-item found inside ha-pick-auth-provider. Not automatically selecting HA provider.");
-      return;
-    }
-
-    firstListItem.click();
+  // Auto-select on "Login aborted".
+  if (!authFlowElement.innerText.includes('Login aborted')) return
+  if (!authProviderElement) return
+  const firstListItem = authProviderElement.shadowRoot?.querySelector('ha-list-item')
+  if (!firstListItem) {
+    console.warn("[OIDC] No ha-list-item found inside ha-pick-auth-provider. Not automatically selecting OIDC provider.")
+    return
+  }
+  firstListItem.click()
 }
 
 // Hide the content until ready
@@ -58,4 +76,5 @@ setTimeout(() => {
 
   // Force display the content
   document.querySelector(".content").style.display = "";
-}, 300)
+  update();
+}, 300)