Forward fresh-login requirements to the authentication provider

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/server/oidc/authorize.go

@@ -246,6 +246,8 @@ func (h *AuthorizeHandler) serveAuthorize(w http.ResponseWriter, r *http.Request
 
 	// Delegate to Auth provider.
 	authURL, err := h.Auth.AuthorizeURL(ctx, domain.AuthRequest{
+		PromptLogin:         promptLogin,
+		MaxAge:              maxAge,
 		ClientID:            clientID,
 		RedirectURI:         redirectURI,
 		State:               state,

src/internal/server/oidc/authorize_test.go

@@ -22,6 +22,7 @@ import (
 
 // mockAuthProvider implements domain.AuthProvider.
 type mockAuthProvider struct {
+	request      domain.AuthRequest
 	authorizeURL string
 	authorizeErr error
 
@@ -29,7 +30,8 @@ type mockAuthProvider struct {
 	callbackErr    error
 }
 
-func (m *mockAuthProvider) AuthorizeURL(_ context.Context, _ domain.AuthRequest) (string, error) {
+func (m *mockAuthProvider) AuthorizeURL(_ context.Context, req domain.AuthRequest) (string, error) {
+	m.request = req
 	if m.authorizeErr != nil {
 		return "", m.authorizeErr
 	}
@@ -871,3 +873,22 @@ func TestAuthorizeHandler_ServeHTTP_DispatchesToCallback(t *testing.T) {
 		}
 	}
 }
+
+func TestFreshLoginRequirementsReachProvider(t *testing.T) {
+	for _, age := range []string{"0", "60"} {
+		auth := &mockAuthProvider{authorizeURL: "https://auth.example/login"}
+		handler := newAuthorizeHandler(auth, &mockMFAProvider{}, &captureEmitter{})
+		params := validAuthorizeParams()
+		params.Set("prompt", "login")
+		params.Set("max_age", age)
+		response := httptest.NewRecorder()
+		handler.ServeHTTP(response, authorizeRequest(params))
+		if response.Code != http.StatusFound {
+			t.Fatalf("authorize failed: %d", response.Code)
+		}
+		expected, _ := time.ParseDuration(age + "s")
+		if !auth.request.PromptLogin || auth.request.MaxAge == nil || *auth.request.MaxAge != expected {
+			t.Fatalf("fresh login requirements lost before provider: %+v", auth.request)
+		}
+	}
+}