Adds a before_login_completed hook to auth_oidc

[weilai-irl]

Adds a before_login_completed hook to auth_oidc so plugins can reject a login before it completes.

[Copilot]

Pull request overview

Adds a new Moodle hook (auth_oidc\hook\before_login_completed) and dispatches it from the OIDC auth code login flow so other plugins can perform additional validation immediately before a login is finalized.

Changes:

• Introduces a new before_login_completed hook class carrying the idtoken.
• Dispatches the hook at three points in the OIDC auth-code login flow, before calling complete_user_login().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
auth/oidc/classes/loginflow/authcode.php	Dispatches the new hook during login handling before finalizing the Moodle session.
auth/oidc/classes/hook/before_login_completed.php	Defines the new hook class and metadata (label/tags) for subscribers.

Suppressed comments (2)

auth/oidc/classes/loginflow/authcode.php:820

• The hook is dispatched before checking that authenticate_user_login() succeeded. To ensure handlers only run when a login is actually about to be completed, move the hook dispatch inside if (!empty($user)) (right before complete_user_login($user)).

            // Look for plugins that want to add extra checks before user login is completed.
            $hook = new \auth_oidc\hook\before_login_completed($idtoken);
            di::get(\core\hook\manager::class)->dispatch($hook);

            if (!empty($user)) {

auth/oidc/classes/loginflow/authcode.php:902

• The hook dispatch currently occurs even when authenticate_user_login() returns empty. This can cause hook handlers to run during failed logins. Wrap the dispatch in the existing if (!empty($user)) block so it only runs when a user is about to be logged in.

            // Look for plugins that want to add extra checks before user login is completed.
            $hook = new \auth_oidc\hook\before_login_completed($idtoken);
            di::get(\core\hook\manager::class)->dispatch($hook);

            if (!empty($user)) {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.