feat(oauth): Allow to skip grant step for selected applications

[come-nc]

• Resolves: Add an option to set oAuth2 applications as trusted, for own external apps which uses oAuth2 sessions #46629

Summary

Before	After
request from application	request from application
	skipped
If not logged in, login screen	If not logged in, login screen
	skipped

To get the skipped version, I ran: occ config:app:set oauth2 skipAuthPickerApplications --type array --value '["me"]', with me being the name associated to my client in oc_oauth2_clients table.

TODO

• Is client name the right thing to match against? (Especially, is that safe?) It should be good, clients (applications) are added and controlled by the admin.
• Is it okay to store the list of bypassing apps in appconfig?
• I suppose ClientFlowLoginV2Controller should be adapted as well? Why are there 2 of those? Not needed, oauth2 uses v1 only
• Why is there a step before login screen? It is now skipped as well for configured applications.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[come-nc]

I added back grant step because I am not comfortable enough with oauth2 to understand if it can be skipped.
So for now only adding an option to skip the first screen, for applications configured only. This has minimal impact and is an improvement already.

[blizzz]

🙈

[julien-nc]

I'm late to the party.

@come-nc

I added back grant step because I am not comfortable enough with oauth2 to understand if it can be skipped.

As long as this can only be enabled with a hidden config, we can also skip the grant step IMO, even if this does not fully respects the oauth specs. I mean, if the goal is to have a transparent oauth flow from a user perspective, the grant step can be removed.