Permissions granted even on Cancel?

[bobmazanec]

As in #7

• thanks for this fork and the original gem!
• my project is scoped to a team/workspace using both the team and team_domain options:

config/initializers/devise.rb

Devise.setup do |config|
  # ...
  config.omniauth :slack,
                  ENV['SLACK_APP_CLIENT_ID'],
                  ENV['SLACK_APP_CLIENT_SECRET'],
                  scope: 'identity.basic, identity.email',
                   team: ENV['SLACK_OAUTH_TEAM_ID'],
            team_domain: ENV['SLACK_OAUTH_TEAM_DOMAIN']

If I am not already signed into the team/workspace, I sign in and arrive at the

On [team], [app] would like to:
Confirm your identity...
[Cancel] [Continue]

page

I overrode OmniauthCallbacksController#after_omniauth_failure_path_for() to take me back to root_path:
app/controllers/users/omniauth_callbacks.rb:

module Users
  # Specialize Devise::RegistrationsController to Invite newly-registered Users
  class OmniauthCallbacksController < Devise::OmniauthCallbacksController
    def after_omniauth_failure_path_for(_)
      root_path
    end

    # ...

and I get this flash:

Could not authenticate you from Slack because "Access denied".

All good so far.

The "cached sign-in?" part

If I click Sign in with Slack again, it does the OAuth dance and signs me in straightaway without asking for permission again.

Is this expected?

Thanks!