Fix OAuth redirect loop by restoring NullResourceOwner behavior

v6.16.0 (1bfb22d) changed resource_owner_authenticator to redirect
unauthenticated users to /users/sign_in, storing the OAuth authorize
URL in session[:user_return_to].  SessionsController#new then called
redirect_with_authentication, which read that URL and appended
show_authentication=signIn — sending the user straight back to
/oauth/authorize, which Doorkeeper immediately bounced back to
/users/sign_in, creating an infinite loop.

The correct fix is to revert resource_owner_authenticator to return
NullResourceOwner.new for unauthenticated requests.  This lets Doorkeeper
render the authorization page, and the AuthorizationPrompt React
component already handles the unauthenticated case: it opens the
sign-in modal and sets afterSignInPath to the OAuth URL so the user is
returned to the consent page after signing in.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nbudin

app/controllers/sessions_controller.rb

@@ -5,27 +5,11 @@ class SessionsController < Devise::SessionsController
   prepend_before_action :set_return_to, only: [:new]
 
   def new
-    respond_to do |format|
-      format.html do
-        if oauth_authorize_flow?
-          # Redirecting back to the OAuth URL would loop: Doorkeeper would
-          # again see no signed-in user and send us right back here.  Instead,
-          # open the sign-in modal on the root page; after sign-in Devise will
-          # redirect to session[:user_return_to] (the OAuth URL).
-          redirect_to root_url(show_authentication: "signIn")
-        else
-          redirect_with_authentication("signIn")
-        end
-      end
-    end
+    respond_to { |format| format.html { redirect_with_authentication("signIn") } }
   end
 
   private
 
-  def oauth_authorize_flow?
-    session[:user_return_to]&.start_with?("/oauth/authorize")
-  end
-
   def set_return_to
     return if params[:user_return_to].blank?
     session[:user_return_to] = params[:user_return_to]

config/initializers/doorkeeper.rb

@@ -13,16 +13,7 @@ def id
   orm :active_record
 
   # This block will be called to check whether the resource owner is authenticated or not.
-  resource_owner_authenticator do
-    if user_signed_in?
-      current_user
-    else
-      # Redirect to login page, preserving the OAuth parameters
-      session[:user_return_to] = request.fullpath
-      redirect_to new_user_session_url
-      nil
-    end
-  end
+  resource_owner_authenticator { user_signed_in? ? current_user : NullResourceOwner.new }
 
   # If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
   # file then you need to declare this block in order to restrict access to the web interface for