From d0dc7f6654da47c400741784f5cdb2c85bd56246 Mon Sep 17 00:00:00 2001 From: oliverhuangcode Date: Sat, 18 Jul 2026 01:38:49 +1000 Subject: [PATCH] feat(auth): force account chooser on social sign-in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set prompt=select_account on the Google and Microsoft providers so the account chooser is always shown during the OAuth handshake. People frequently have several accounts signed in (e.g. a personal Gmail alongside their student one), and the provider silently auto-selecting the wrong one is a common cause of a member being told they aren't one downstream. This only affects the OAuth step. An existing MAC session is reused as before — signed-in users are not re-prompted or logged out; the chooser appears only when someone actually logs in (no session yet). Co-Authored-By: Claude Opus 4.8 --- auth/src/auth.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/auth/src/auth.ts b/auth/src/auth.ts index f87d751..b0f0cdc 100644 --- a/auth/src/auth.ts +++ b/auth/src/auth.ts @@ -98,15 +98,23 @@ export const auth = betterAuth({ }, socialProviders: { + // `prompt: "select_account"` forces the provider's account chooser during the + // OAuth handshake so people with several signed-in accounts (e.g. a personal + // Gmail alongside their student one) consciously pick the right one, rather + // than the provider silently auto-selecting the wrong account. This only + // affects the OAuth step itself — it does NOT run when an existing MAC session + // is reused, so signed-in users are not re-prompted or logged out. google: { clientId: process.env.GOOGLE_CLIENT_ID as string, clientSecret: process.env.GOOGLE_CLIENT_SECRET as string, + prompt: "select_account", }, microsoft: { clientId: process.env.MICROSOFT_CLIENT_ID as string, clientSecret: process.env.MICROSOFT_CLIENT_SECRET as string, // "common" so personal Microsoft accounts (Hotmail/Outlook/Live) work too. tenantId: "common", + prompt: "select_account", }, },