feat(oauth): Allow bypass of grant step for selected applications

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

Author: come-nc

core/Controller/ClientFlowLoginController.php

@@ -26,6 +26,7 @@
 use OCP\Authentication\Exceptions\InvalidTokenException;
 use OCP\Defaults;
 use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\IRequest;
 use OCP\ISession;
@@ -55,6 +56,7 @@ public function __construct(
 		private ICrypto $crypto,
 		private IEventDispatcher $eventDispatcher,
 		private ITimeFactory $timeFactory,
+		private IAppConfig $appConfig,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -157,9 +159,11 @@ public function showAuthPickerPage(string $clientIdentifier = '', string $user =
 	#[NoCSRFRequired]
 	#[UseSession]
 	#[FrontpageRoute(verb: 'GET', url: '/login/flow/grant')]
-	public function grantPage(string $stateToken = '',
+	public function grantPage(
+		string $stateToken = '',
 		string $clientIdentifier = '',
-		int $direct = 0): StandaloneTemplateResponse {
+		int $direct = 0,
+	): Response {
 		if (!$this->isValidToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -181,6 +185,10 @@ public function grantPage(string $stateToken = '',
 		/** @var IUser $user */
 		$user = $this->userSession->getUser();
 
+		if (in_array($clientName, $this->appConfig->getValueArray('oauth2', 'autoGrantApplications', []))) {
+			return $this->generateAppPassword($stateToken, $clientIdentifier);
+		}
+
 		$response = new StandaloneTemplateResponse(
 			$this->appName,
 			'loginflow/grant',
@@ -203,14 +211,13 @@ public function grantPage(string $stateToken = '',
 		return $response;
 	}
 
-	/**
-	 * @return Http\RedirectResponse|Response
-	 */
 	#[NoAdminRequired]
 	#[UseSession]
 	#[FrontpageRoute(verb: 'POST', url: '/login/flow')]
-	public function generateAppPassword(string $stateToken,
-		string $clientIdentifier = '') {
+	public function generateAppPassword(
+		string $stateToken,
+		string $clientIdentifier = '',
+	): Response {
 		if (!$this->isValidToken($stateToken)) {
 			$this->session->remove(self::STATE_NAME);
 			return $this->stateTokenForbiddenResponse();