fix: skip hinted login if pipeline already running

[jono-booth]

login_and_registration_form checks tpa_hint before checking saml_provider:

# Lines 167-183: tpa_hint + skip_hinted_login_dialog → RETURN to Auth0 (no pipeline check!)
if '?' in redirect_to:
  if tpa_hint_provider.skip_hinted_login_dialog:
      return redirect(pipeline.get_login_url(...))  #  loops back to Auth0

# Lines 196-208: saml_provider check (never reached if above fires)
running_pipeline = pipeline.get(request)
if running_pipeline:
  saml_provider, __ = is_saml_provider(...)
if should_redirect_to_authn_microfrontend() and not saml_provider:
  return redirect(AUTHN_MFE_URL)

Once redirect_to has tpa_hint from THIRD_PARTY_AUTH_HINT, the function redirects to Auth0 without ever checking if a SAML pipeline is already running. The pipeline check at line 197 is never reached.

Two changes, working together:

1. running_pipeline is computed first (lines 163-169) — before any tpa_hint check. Previously it was computed at line 197, unreachable if the skip_hinted_login_dialog redirect fired.
2. and not running_pipeline added to the redirect condition (line 182) — if a TPA pipeline is already in flight, the skip_hinted_login_dialog redirect is suppressed. The user falls through to initial_mode = "hinted_login" and sees the login/register form with the provider pre-selected, which is the correct behavior for a new SAML user who needs to complete registration.

[Copilot]

Pull request overview

This PR fixes an infinite redirect loop that could occur for new SAML users when a provider has skip_hinted_login_dialog = True and the ?next= URL contains a tpa_hint parameter. Without the fix, the function would redirect the user back to the Auth0/SAML provider even when a TPA pipeline was already in flight (e.g., a new SAML user needing to complete registration), causing an infinite loop. The fix works by computing the running pipeline state early and using it to suppress the automatic redirect.

Changes:

• The running_pipeline and saml_provider detection block is moved earlier in the function (before the tpa_hint processing) so it is available to guard the skip_hinted_login_dialog redirect.
• A and not running_pipeline condition is added to the skip_hinted_login_dialog redirect guard, preventing re-dispatch to the provider when a pipeline is already in progress.
• The duplicate original pipeline-detection block (which was now unreachable in the bug scenario) is removed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.