fix(auth): allow configuring OAuth prompt parameter

Merge #5818

Closes #3046

## Summary

`AuthHandler.generate_auth_uri()` currently hardcodes `prompt=consent` when building OAuth authorization URLs.

That makes app-level OAuth configuration less flexible than the underlying providers allow. Flows that need `prompt=none` (or another prompt mode) cannot express that through `OAuth2Auth`, even though the rest of the OAuth request metadata is already configurable.

This change adds an optional `prompt` field to `OAuth2Auth`, preserves `consent` as the default, and uses the configured value when generating the authorization URL.

## Changes

- `src/google/adk/auth/auth_credential.py`
  - Add optional `prompt` field to `OAuth2Auth`.
- `src/google/adk/auth/auth_handler.py`
  - Use `auth_credential.oauth2.prompt or "consent"` when populating OAuth authorization params.
- `tests/unittests/auth/test_auth_handler.py`
  - Extend the OAuth session test double to surface `prompt` in generated auth URIs.
  - Assert the default OAuth flow still includes `prompt=consent`.
  - Add coverage for a custom `prompt="none"` override.

## Test plan

- [x] `python3.12 -m py_compile src/google/adk/auth/auth_credential.py src/google/adk/auth/auth_handler.py tests/unittests/auth/test_auth_handler.py`
- [ ] `PYTHONPATH=src .venv/bin/python -m pytest tests/unittests/auth/test_auth_handler.py -q`
  - Blocked locally while bootstrapping a minimal ad hoc venv: importing `google.adk` for this test path pulls additional runtime dependencies (`google.genai`, `opentelemetry.semconv`, and friends). I stopped after confirming the touched files compile cleanly rather than trying to recreate the repo's full `uv sync --all-extras` environment by hand.
- [ ] Reviewer / CI confirmation that the existing auth handler unit suite passes in the standard repo environment.

Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=#5818 from RaghunandanKumar:fix/oauth-prompt-configurable 727e2e5
PiperOrigin-RevId: 943553106

Author: 2 people

src/google/adk/auth/auth_credential.py

@@ -87,6 +87,7 @@ class OAuth2Auth(BaseModelWithConfig):
   expires_at: int | None = None
   expires_in: int | None = None
   audience: str | None = None
+  prompt: str | None = None
   code_verifier: str | None = None
   code_challenge_method: str | None = None
   token_endpoint_auth_method: (

src/google/adk/auth/auth_handler.py

@@ -211,7 +211,7 @@ def generate_auth_uri(
     )
     params = {
         "access_type": "offline",
-        "prompt": "consent",
+        "prompt": auth_credential.oauth2.prompt or "consent",
     }
     if auth_credential.oauth2.audience:
       params["audience"] = auth_credential.oauth2.audience

tests/unittests/auth/test_auth_handler.py

@@ -67,6 +67,8 @@ def create_authorization_url(self, url, **kwargs):
     params = f"client_id={self.client_id}&scope={self.scope}"
     if kwargs.get("audience"):
       params += f"&audience={kwargs.get('audience')}"
+    if kwargs.get("prompt"):
+      params += f"&prompt={kwargs.get('prompt')}"
     return f"{url}?{params}", "mock_state"
 
   def fetch_token(
@@ -251,6 +253,25 @@ def test_generate_auth_uri_with_audience_and_prompt(
     result = handler.generate_auth_uri()
 
     assert "audience=test_audience" in result.oauth2.auth_uri
+    assert "prompt=consent" in result.oauth2.auth_uri
+
+  @patch("google.adk.auth.auth_handler.OAuth2Session", MockOAuth2Session)
+  def test_generate_auth_uri_with_custom_prompt(
+      self, openid_auth_scheme, oauth2_credentials
+  ):
+    """Test generating an auth URI with a custom prompt override."""
+    oauth2_credentials.oauth2.prompt = "none"
+    exchanged = oauth2_credentials.model_copy(deep=True)
+
+    config = AuthConfig(
+        auth_scheme=openid_auth_scheme,
+        raw_auth_credential=oauth2_credentials,
+        exchanged_auth_credential=exchanged,
+    )
+    handler = AuthHandler(config)
+    result = handler.generate_auth_uri()
+
+    assert "prompt=none" in result.oauth2.auth_uri
 
   @patch("google.adk.auth.auth_handler.OAuth2Session", MockOAuth2Session)
   def test_generate_auth_uri_openid(
@@ -299,7 +320,7 @@ def test_generate_auth_uri_client_credentials_with_missing_scopes(
 
     assert (
         result.oauth2.auth_uri
-        == "https://example.com/oauth2/token?client_id=mock_client_id&scope="
+        == "https://example.com/oauth2/token?client_id=mock_client_id&scope=&prompt=consent"
     )
     assert result.oauth2.state == "mock_state"