From c0b9a48c7a75342a4a87dbfb2cd2889dfd244ad9 Mon Sep 17 00:00:00 2001
From: Luna Seemann <luna@wamellow.com>
Date: Tue, 16 Jun 2026 21:35:24 +0200
Subject: [PATCH] fix(oauth): hide account switcher with login hint

---
 server/handle_oauth_authorize.go | 31 +++++++++++++++++--------------
 server/templates/authorize.html  |  2 +-
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/server/handle_oauth_authorize.go b/server/handle_oauth_authorize.go
index 0c43dc6..5941942 100644
--- a/server/handle_oauth_authorize.go
+++ b/server/handle_oauth_authorize.go
@@ -51,12 +51,13 @@ func (s *Server) handleOauthAuthorizeGet(e echo.Context) error {
 			// render page for logged out dev
 			if s.config.Version == "dev" && parRequest.ClientID == "" {
 				return e.Render(200, "authorize.html", map[string]any{
-					"Scopes":     []string{"atproto", "transition:generic"},
-					"AppName":    "DEV MODE AUTHORIZATION PAGE",
-					"Handle":     "paula.cocoon.social",
-					"RequestUri": "",
-					"Accounts":   []string{},
-					"ActiveDid":  "",
+					"Scopes":       []string{"atproto", "transition:generic"},
+					"AppName":      "DEV MODE AUTHORIZATION PAGE",
+					"Handle":       "paula.cocoon.social",
+					"RequestUri":   "",
+					"Accounts":     []string{},
+					"ActiveDid":    "",
+					"HasLoginHint": false,
 				})
 			}
 			return helpers.InputError(e, to.StringPtr("no request uri and invalid parameters"))
@@ -134,7 +135,8 @@ func (s *Server) handleOauthAuthorizeGet(e echo.Context) error {
 		return helpers.ServerError(e, to.StringPtr(err.Error()))
 	}
 
-	if req.Parameters.LoginHint != nil && *req.Parameters.LoginHint != "" {
+	hasLoginHint := req.Parameters.LoginHint != nil && *req.Parameters.LoginHint != ""
+	if hasLoginHint {
 		did, err := s.resolveLoginHintToDid(ctx, *req.Parameters.LoginHint)
 		if err != nil || !slices.Contains(getSessionDids(sess), did) {
 			return e.Redirect(303, "/account/signin?"+e.QueryParams().Encode())
@@ -159,13 +161,14 @@ func (s *Server) handleOauthAuthorizeGet(e echo.Context) error {
 	appName := client.Metadata.ClientName
 
 	data := map[string]any{
-		"Scopes":      scopes,
-		"AppName":     appName,
-		"RequestUri":  input.RequestUri,
-		"QueryParams": e.QueryParams().Encode(),
-		"Handle":      repo.Actor.Handle,
-		"Accounts":    accounts,
-		"ActiveDid":   repo.Repo.Did,
+		"Scopes":       scopes,
+		"AppName":      appName,
+		"RequestUri":   input.RequestUri,
+		"QueryParams":  e.QueryParams().Encode(),
+		"Handle":       repo.Actor.Handle,
+		"Accounts":     accounts,
+		"ActiveDid":    repo.Repo.Did,
+		"HasLoginHint": hasLoginHint,
 	}
 
 	return e.Render(200, "authorize.html", data)
diff --git a/server/templates/authorize.html b/server/templates/authorize.html
index 6c3180d..cf28211 100644
--- a/server/templates/authorize.html
+++ b/server/templates/authorize.html
@@ -17,7 +17,7 @@ <h2>Authorizing with {{ .AppName }}</h2>
         You are signed in as <b>{{ .Handle }}</b>.
         <a href="/account/signout?{{ .QueryParams }}">Sign out this account</a>
       </p>
-      {{ if gt (len .Accounts) 1 }}
+      {{ if and (not .HasLoginHint) (gt (len .Accounts) 1) }}
       <form action="/account/switch" method="post">
         <input type="hidden" name="query_params" value="{{ .QueryParams }}" />
         <input type="hidden" name="next" value="/oauth/authorize" />