feat(core): add OAuth2 consent flow support

[Jorgagu]

Add complete OAuth2 consent flow support to @ory/nextjs and @ory/elements-react packages, enabling applications to handle OAuth2 authorization consent screens with Ory Hydra.

Related Issue or Design Document

Fixex #327

Add complete OAuth2 consent flow support to @ory/nextjs and @ory/elements-react packages, enabling applications to handle OAuth2 authorization consent screens with Ory Hydra.

Features

• Consent Flow Utilities (@ory/nextjs)

  • getConsentFlow - Fetch consent challenge from Ory Hydra
  • acceptConsentRequest - Accept consent with selected scopes
  • rejectConsentRequest - Reject consent request

• OAuth2 Client Logo Display

  • Display OAuth2 client logo on login, registration, and consent cards
  • Shared getConfigWithOAuth2Logo utility for consistent behavior

• Example Implementations

  • App Router: consent page + API route
  • Pages Router: consent page + API route
  • Custom Components: ConsentFooter, custom scope checkbox with toggle switches

• Exported Utilities

  • getConsentNodeKey, isFooterNode from card-consent
  • isUiNodeInput, UiNodeInput type helpers

Improvements

• Optimize rewriteUrls to single-pass regex replacement
• Add OAuth2 path exclusion in URL rewriting
• Add null/undefined handling in rewriteJsonResponse

Tests

• Unit tests for consent utilities and rewrite functions

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

This implementation follows the pattern established in kratos-selfservice-ui-node for handling OAuth2 flows. The OAuth2 client logo is displayed by overriding the project configuration's logo_light_url when an OAuth2 client logo is available, keeping the existing DefaultCardLogo component unchanged.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cb7ce4f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@Jorgagu is attempting to deploy a commit to the ory Team on Vercel.

A member of the Team first needs to authorize it.

[codecov]

Codecov Report

❌ Patch coverage is 49.54955% with 56 lines in your changes missing coverage. Please review.
✅ Project coverage is 55.61%. Comparing base (f3fad4d) to head (cb7ce4f).
⚠️ Report is 273 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #584       +/-   ##
===========================================
+ Coverage   42.43%   55.61%   +13.18%     
===========================================
  Files         136      177       +41     
  Lines        2008     3278     +1270     
  Branches      288      481      +193     
===========================================
+ Hits          852     1823      +971     
- Misses       1149     1387      +238     
- Partials        7       68       +61     

Components	Coverage Δ
@ory/elements-react	54.88% <ø> (+18.09%)	⬆️
@ory/nextjs	59.23% <ø> (-6.75%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Jorgagu]

@vinckr @jonas-jonas @aeneasr Happy New Year ! 🎉 Could you please review this one ?

[jonas-jonas]

hi @Jorgagu, thank you very much for this contribution, and happy new year!

We'll take a look at this in the coming weeks. We do have some code for this already; it just wasn't ready to be published, so we might need to do some merging with that.

And just a heads-up, we're quite busy ramping up after the holidays again, so it might take a couple days longer for us to get to this.