feat(auth): skip ePDS consent screen on first-time sign-up

[s-adamantine]

What

Adds the ePDS epds_skip_consent_on_signup: true extension to Certified's OAuth client metadata (/.well-known/oauth-client-metadata).

This removes the "Authorize your account" consent screen that first-time users currently hit during sign-up, so new accounts land straight in the app.

Why

Apps that delegate sign-in to the certs provider (e.g. the GainForest frontend) bounce users through certified.one's OAuth flow, and the ePDS shows its stock consent screen on a user's first sign-up. The ePDS exposes a client-metadata opt-out for exactly this case.

Changes

• src/app/.well-known/oauth-client-metadata/route.ts — advertise epds_skip_consent_on_signup: true alongside the existing ePDS extension fields.

This is the only change required in this repo.

Operator-side prerequisite (not in this repo, for reference)

The flag is only honoured when the certified.one PDS is configured with:

• PDS_SIGNUP_ALLOW_CONSENT_SKIP=true
• this client_id present on PDS_OAUTH_TRUSTED_CLIENTS

(certified-app is already a trusted client — its brand_color / email_template_uri only work for trusted clients — so realistically only PDS_SIGNUP_ALLOW_CONSENT_SKIP=true needs flipping.)

Scope

Skips consent on initial sign-up (new accounts) only, matching "first time someone signs in". An existing account's very first authorization to this client still shows consent once, then it's remembered.

Summary by CodeRabbit

• New Features
  • OAuth client metadata now advertises support for skipping consent during signup for eligible trusted clients.
  • This capability is only available when the service is configured to allow consent skipping and the client is approved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
certified-app	Ready	Preview, Comment	Jun 26, 2026 4:44pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f02f3483-ecab-4c75-a38d-b5239214a6c7

📥 Commits

Reviewing files that changed from the base of the PR and between 59cac79 and 2ccabd1.

📒 Files selected for processing (1)

• src/app/.well-known/oauth-client-metadata/route.ts

---

📝 Walkthrough

Walkthrough

The OAuth client metadata response now includes epds_skip_consent_on_signup: true, along with comments stating it is honored only when consent skipping is enabled and the client is trusted.

Changes

OAuth client metadata extension

Layer / File(s)	Summary
Add consent-skip metadata src/app/.well-known/oauth-client-metadata/route.ts	The GET response adds epds_skip_consent_on_signup: true and comments describing the signup-consent and trusted-client conditions.

Sequence Diagram(s)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 I hopped through the metadata glade,
With one tiny flag, consent was laid.
Trusty clients wink, the route replies,
Ears up high beneath the skies.
Hop, hop, yay — the JSON sings!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding support to skip the ePDS consent screen during first-time sign-up.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sharfy-skip-signup-consent

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}