fix: fall back to regular OIDC when silent auth fails

When prompt=none fails with login_required (no Authentik session),
automatically redirect to regular OIDC flow to show login UI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.4] - 2026-01-04
+
+### Fixed
+- Silent OIDC fallback: when `prompt=none` fails with `login_required` (no Authentik session), automatically fall back to regular OIDC flow to show login UI
+
 ## [1.1.3] - 2026-01-04
 
 ### Changed

lib/routing/app_router.dart

@@ -137,6 +137,13 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
 
     // Check for error from Authentik
     if (widget.error != null) {
+      // Silent OIDC (prompt=none) failed - no existing session
+      // Fall back to regular OIDC flow to show login UI
+      if (widget.error == 'login_required') {
+        ref.read(authProvider.notifier).signIn();
+        return;
+      }
+
       setState(() {
         _isProcessing = false;
         _error = widget.errorDescription ?? widget.error;

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.1.3+1
+version: 1.1.4+1
 
 environment:
   sdk: ^3.10.4