fix(auth): use prompt=login instead of select_account for OIDC sign-in

apps/web/src/lib/server/auth/__tests__/provider-registration.test.ts

@@ -23,6 +23,23 @@ describe('buildGenericOAuthConfigs', () => {
     expect(cfgs[0].disableSignUp).toBe(false)
   })
 
+  it('requests the broadly-supported prompt=login, not the OIDC-optional select_account', async () => {
+    const cfgs = await buildGenericOAuthConfigs({
+      providers: [
+        {
+          id: 'idp_abc',
+          registrationId: 'sso',
+          enabled: true,
+          autoCreateUsers: true,
+          discoveryUrl: 'https://x/.well-known/openid-configuration',
+        },
+      ] as any,
+      creds: async () => ({ clientId: 'c', clientSecret: 's' }),
+      tierAllowsOidc: true,
+    })
+    expect(cfgs[0].prompt).toBe('login')
+  })
+
   it('skips disabled providers and providers without credentials', async () => {
     const cfgs = await buildGenericOAuthConfigs({
       providers: [

apps/web/src/lib/server/auth/build-oauth-configs.ts

@@ -132,7 +132,7 @@ export async function buildGenericOAuthConfigs({
       pkce: true,
       // Force the account picker so an admin typing a specific email isn't
       // silently signed in as whoever the IdP already has a session for.
-      prompt: 'select_account',
+      prompt: 'login',
       // Better-Auth's JIT block. When false, the OAuth callback aborts in
       // handleOAuthUserInfo before any user/session is created. Existing
       // users still link via accountLinking.trustedProviders.