Include openid scope in OIDC authentication requests

CHANGELOG.md

@@ -2,10 +2,12 @@
 
 All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
 
-## [0.1.1] - 2026-04-XX
+## [1.0.1] - 2026-04-25
 
 ### Added
-- Logout users from OIDC provider when logging out of the app.
+- OIDC:
+    - Logout users from IdP when logging out of the app.
+    - Include `openid` scope in OIDC authentication requests.
 
 ### Changed
 
@@ -14,7 +16,7 @@ All notable changes to this project will be documented in this file. This projec
 - Editing a secret clears its masked value.
 - Array label properties crashes app.
 
-## [0.1.0] - 2026-04-20
+## [1.0.0] - 2026-04-20
 
 ### Added
 - Initial release.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "stalwart-webui",
   "private": true,
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Stalwart WebUI",
   "type": "module",
   "scripts": {

src/services/auth/oauth.ts

@@ -17,6 +17,7 @@ interface DiscoveryResponse {
   authorization_endpoint: string;
   token_endpoint: string;
   end_session_endpoint?: string;
+  scopes_supported?: string[];
 }
 
 export async function discover(username: string): Promise<DiscoveryResponse> {
@@ -124,7 +125,8 @@ function getRedirectUri(): string {
 }
 
 export async function startAuthFlow(username: string, returnUrl?: string | null): Promise<void> {
-  const { authorization_endpoint, token_endpoint, end_session_endpoint } = await discover(username);
+  const { authorization_endpoint, token_endpoint, end_session_endpoint, scopes_supported } =
+    await discover(username);
 
   const codeVerifier = generateCodeVerifier();
   const { challenge: codeChallenge, method: codeChallengeMethod } = await generateCodeChallenge(codeVerifier);
@@ -161,8 +163,14 @@ export async function startAuthFlow(username: string, returnUrl?: string | null)
     prompt: 'login',
   });
 
-  if (SCOPES && SCOPES.length > 0) {
-    params.set('scope', SCOPES);
+  const scope =
+    SCOPES && SCOPES.length > 0
+      ? SCOPES
+      : scopes_supported?.includes('openid')
+        ? 'openid'
+        : '';
+  if (scope) {
+    params.set('scope', scope);
   }
 
   window.location.href = `${authorization_endpoint}?${params.toString()}`;