Forward fresh-login requirements to the authentication provider

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/adapters/authelia/adapter.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -54,6 +55,12 @@ func (a *AutheliaAdapter) AuthorizeURL(_ context.Context, req domain.AuthRequest
 	q.Set("response_type", "code")
 	q.Set("state", req.State)
 	q.Set("scope", "openid profile email groups")
+	if req.PromptLogin {
+		q.Set("prompt", "login")
+	}
+	if req.MaxAge != nil {
+		q.Set("max_age", strconv.FormatInt(int64(req.MaxAge.Seconds()), 10))
+	}
 
 	return base + "?" + q.Encode(), nil
 }

src/internal/adapters/authelia/adapter_test.go

@@ -452,3 +452,23 @@ func TestHandleCallback_AuthResultContainsNoRawTokens(t *testing.T) {
 		t.Error("AuthResult.Claims must not expose raw access_token — security boundary violation")
 	}
 }
+
+func TestAuthorizeURLForwardsFreshLoginRequirements(t *testing.T) {
+	adapter := authelia.New(testConfig(), &mockHTTPClient{})
+	for _, seconds := range []int{0, 60} {
+		age := time.Duration(seconds) * time.Second
+		target, err := adapter.AuthorizeURL(context.Background(), domain.AuthRequest{PromptLogin: true, MaxAge: &age})
+		if err != nil {
+			t.Fatal(err)
+		}
+		parsed, _ := url.Parse(target)
+		if parsed.Query().Get("prompt") != "login" || parsed.Query().Get("max_age") != fmt.Sprint(seconds) {
+			t.Fatalf("freshness requirements missing from provider URL: %s", target)
+		}
+	}
+	target, _ := adapter.AuthorizeURL(context.Background(), domain.AuthRequest{})
+	parsed, _ := url.Parse(target)
+	if parsed.Query().Has("prompt") || parsed.Query().Has("max_age") {
+		t.Fatal("ordinary SSO was changed")
+	}
+}