We now have a healthy collection of various plugins that potentially prompt the user to do something after login and redirect to some page to do things.

https://docs.moodle.org/dev/Login_callbacks#after_require_login

Some plugin example:

• auth_enrolkey - can show you the list of courses you've just been auto enrolled into
• tool_securityquestions - have a more secure workflow for resetting forgotten passwords
• tool_mfa - you need to either setup or enter a 2FA code

There are other things like editing your profile which is core.

Basically all of these things are vying for your attention. Increasingly when you start installing and using more of these plugins together you have situations were create redirect loops because plugin A is saying hey you aren't setup so come to page A and then on that page plugin B is saying hey come to page B. Neither redirects if they are on their own page so you just toggle back and forth.

Also some are clearly more important and should be done earlier than others, so you should confirm your MFA before you see your enrolled courses.

So what I'm proposing is a new API where instead of each plugin trying to take over the flow after login, they instead declare a wantsurl that they want to use to visit after login and it gets added to the queue. Core will manage which wantsurl is active and make sure the user goes there if they aren't there. Each plugin declares a priority of some sort.

Roughly something along the lines of a new callback or a new auto loaded class:

function tool_myplugin_wantsurl() {

    global $SESSION;

    // If something isn't setup

    return [

        'redirect' => '/admin/tool/plugin/setup.php',

        'priority' => CRITICAL | WARNING | INFO

        'exempt' => '/admin/tool/plugin/',

    ];

}

Possibly each plugin author won't know where they fit in the priority so maybe this needs to be config. So they would just declare a default priority and you'd have an admin setting which shows the order of all the plugins which declare this and you an shuffled them around.

Anything set in the session wants url would only get resolved if this queue is empty.

Unlike the existing wantsurl which is managed in the session this would be stateless and evaluated each time. Each plugin should manage it's own state internally and decide when or what to push into the queue.