fix(toolkit): disallow none combined with other prompts in oidcPromptsGuard (#9565)

.changeset/oidc-prompt-none-validation.md

@@ -0,0 +1,5 @@
+---
+"@logto/connector-kit": patch
+---
+
+disallow combining the `none` prompt with other prompt values in OIDC configuration

packages/toolkit/connector-kit/src/types/social.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+
+import { oidcPromptsGuard, OidcPrompt } from './social.js';
+
+describe('oidcPromptsGuard', () => {
+  it('allows valid prompt configurations, including undefined, single prompts, and combinations without none', () => {
+    expect(oidcPromptsGuard.safeParse([OidcPrompt.None]).success).toBe(true);
+    expect(oidcPromptsGuard.safeParse([OidcPrompt.Consent]).success).toBe(true);
+    expect(oidcPromptsGuard.safeParse([OidcPrompt.SelectAccount, OidcPrompt.Consent]).success).toBe(
+      true
+    );
+    // eslint-disable-next-line unicorn/no-useless-undefined -- undefined is a valid optional value under test
+    expect(oidcPromptsGuard.safeParse(undefined).success).toBe(true);
+  });
+
+  it('rejects none when combined with other prompts', () => {
+    const result = oidcPromptsGuard.safeParse([
+      OidcPrompt.SelectAccount,
+      OidcPrompt.Consent,
+      OidcPrompt.None,
+    ]);
+    expect(result.success).toBe(false);
+  });
+});

packages/toolkit/connector-kit/src/types/social.ts

@@ -18,6 +18,9 @@ export type OidcPrompts = OidcPrompt[];
 export const oidcPromptsGuard: z.ZodType<Optional<OidcPrompts>> = z
   .nativeEnum(OidcPrompt)
   .array()
+  .refine((prompts) => !prompts.includes(OidcPrompt.None) || prompts.length === 1, {
+    message: 'The `none` prompt cannot be combined with other prompts.',
+  })
   .optional();
 
 // This type definition is for SAML connector