OAuth server: an existing grant auto-approves and returns no client details, leaving no room for an account-confirmation step

Summary GoTrue's OAuth server does not honour the standard OIDC prompt parameter (OIDC Core 1.0 §3.1.2.1). As a consequence, when the signed-in user already has a grant covering the requested scopes, GET /oauth/authorizations/{authorization_id} does two things at once: 1. it issues the authorization code and returns { "redirect_url": "...?code=..." }, and 2. it omits everything a consent UI would need to render — no client, no user, no scope. Because both happen inside a single unparameterised GET, a custom authorization UI configured for GoTrue's OAuth server cannot present the "you are signed in as X, continue?" step that Google, Microsoft and Okta show on a repeat authorization. There is no point at which the code has not yet been issued *and* the client is still known. Current behaviour First authorization (no grant yet) — full details: Repeat authorization (grant exists, same scopes) — a destination only: …