Show an existing NetKingdom sign-in before the account site continues it.

The account site said "Not signed in" while Authelia still had a session, and Sign in reused that identity. Ask Authelia who the session cookie is, show that name, and send a fresh sign-in only when a different identity is requested.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

src/user_engine/oidc.py

@@ -53,7 +53,14 @@ class OIDCClient:
         self.pending: dict[str, PendingLogin] = {}
         self.sessions: dict[str, BrowserSession] = {}
 
-    def begin(self, *, tenant_hint: str | None = None, recovery: bool = False, return_path: str = "/") -> str:
+    def begin(
+        self,
+        *,
+        tenant_hint: str | None = None,
+        recovery: bool = False,
+        fresh: bool = False,
+        return_path: str = "/",
+    ) -> str:
         if return_path not in {"/", "/platform", "/platform/factor-recovery", "/platform/authentication-policy"}:
             raise ValueError("unsupported login return path")
         state = secrets.token_urlsafe(32)
@@ -72,6 +79,10 @@ class OIDCClient:
         }
         if recovery:
             parameters.update(prompt="login", max_age="0", acr_values="aal2")
+        elif fresh:
+            # KeyCape asks Authelia for a session inside its short fresh window
+            # and then requires that authentication to be newer than this request.
+            parameters.update(prompt="login", max_age="0")
         if tenant_hint:
             parameters["tenant_hint"] = tenant_hint
         return f"{self.issuer}/authorize?{urlencode(parameters)}"