RedirectURL defaults, URL composition (#2283)

* add defaults

* config generate

Author: matoszz

config/.env.example

@@ -290,16 +290,16 @@ CORE_INTEGRATIONS_GITHUBAPP_WEBHOOKSECRET=""
 CORE_INTEGRATIONS_GITHUBAPP_APPSLUG=""
 CORE_INTEGRATIONS_SLACK_CLIENTID=""
 CORE_INTEGRATIONS_SLACK_CLIENTSECRET=""
-CORE_INTEGRATIONS_SLACK_REDIRECTURL=""
+CORE_INTEGRATIONS_SLACK_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_GOOGLEWORKSPACE_CLIENTID=""
 CORE_INTEGRATIONS_GOOGLEWORKSPACE_CLIENTSECRET=""
-CORE_INTEGRATIONS_GOOGLEWORKSPACE_REDIRECTURL=""
+CORE_INTEGRATIONS_GOOGLEWORKSPACE_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_AZUREENTRAID_CLIENTID=""
 CORE_INTEGRATIONS_AZUREENTRAID_CLIENTSECRET=""
-CORE_INTEGRATIONS_AZUREENTRAID_REDIRECTURL=""
+CORE_INTEGRATIONS_AZUREENTRAID_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_MICROSOFTTEAMS_CLIENTID=""
 CORE_INTEGRATIONS_MICROSOFTTEAMS_CLIENTSECRET=""
-CORE_INTEGRATIONS_MICROSOFTTEAMS_REDIRECTURL=""
+CORE_INTEGRATIONS_MICROSOFTTEAMS_REDIRECTURL="https://api.theopenlane.io/v1/integrations/auth/callback"
 CORE_INTEGRATIONS_OIDCLOCAL_ENABLED="false"
 CORE_INTEGRATIONS_OIDCLOCAL_CLIENTID="local-core-oidc"
 CORE_INTEGRATIONS_OIDCLOCAL_CLIENTSECRET="local-core-oidc-secret"

config/config.example.yaml

@@ -170,7 +170,7 @@ integrations:
     azureentraid:
         clientid: ""
         clientsecret: ""
-        redirecturl: ""
+        redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
     githubapp:
         appid: ""
         appslug: ""
@@ -179,11 +179,11 @@ integrations:
     googleworkspace:
         clientid: ""
         clientsecret: ""
-        redirecturl: ""
+        redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
     microsoftteams:
         clientid: ""
         clientsecret: ""
-        redirecturl: ""
+        redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
     oidclocal:
         clientid: local-core-oidc
         clientsecret: local-core-oidc-secret
@@ -193,7 +193,7 @@ integrations:
     slack:
         clientid: ""
         clientsecret: ""
-        redirecturl: ""
+        redirecturl: https://api.theopenlane.io/v1/integrations/auth/callback
 jobqueue:
     connectionuri: postgres://postgres:password@0.0.0.0:5432/jobs?sslmode=disable
     metrics:

config/helm-values.yaml

@@ -536,16 +536,16 @@ coreConfiguration:
       appslug: ""  # @schema type:string
     slack:
       clientid: ""  # @schema type:string
-      redirecturl: ""  # @schema type:string
+      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
     googleworkspace:
       clientid: ""  # @schema type:string
-      redirecturl: ""  # @schema type:string
+      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
     azureentraid:
       clientid: ""  # @schema type:string
-      redirecturl: ""  # @schema type:string
+      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
     microsoftteams:
       clientid: ""  # @schema type:string
-      redirecturl: ""  # @schema type:string
+      redirecturl: "https://api.theopenlane.io/v1/integrations/auth/callback"  # @schema type:string; default:https://api.theopenlane.io/v1/integrations/auth/callback
     oidclocal:
       enabled: false  # @schema type:boolean; default:false
       clientid: "local-core-oidc"  # @schema type:string; default:local-core-oidc

internal/httpserve/handlers/integration_flow.go

@@ -4,6 +4,7 @@ import (
 	"maps"
 	"net/http"
 	"slices"
+	"strings"
 
 	echo "github.com/theopenlane/echox"
 
@@ -88,8 +89,8 @@ func (h *Handler) StartIntegrationAuth(ctx echo.Context, openapiCtx *OpenAPICont
 	}
 
 	// ConsoleURL is the full base URL for the frontend (e.g. https://console.theopenlane.io).
-	// The redirect path is derived from the definition ID so the browser lands on the integration detail page.
-	redirectTo := h.ConsoleURL + "/organization-settings/integrations/" + def.ID
+	// Accept either form with or without a trailing slash.
+	redirectTo := strings.TrimRight(h.ConsoleURL, "/") + "/organization-settings/integrations/" + def.ID
 	cookies["redirect_to"] = redirectTo
 
 	sessions.SetCookies(ctx.Response().Writer, cfg, cookies)

internal/httpserve/handlers/integration_flow_test.go

@@ -209,6 +209,23 @@ func (suite *HandlerTestSuite) TestStartOAuthFlow_SetsDefinitionBasedRedirectCoo
 	require.Equal(t, "http://console.example/organization-settings/integrations/"+testAuthDefinitionID, cookies["redirect_to"].Value)
 }
 
+func (suite *HandlerTestSuite) TestStartOAuthFlow_SetsDefinitionBasedRedirectCookie_WithTrailingSlashConsoleURL() {
+	t := suite.T()
+
+	suite.h.ConsoleURL = "http://console.example/"
+
+	op := suite.createImpersonationOperation("StartIntegrationOAuthRedirectCookieTrailingSlash", "Start integration OAuth flow")
+	suite.registerRouteOnce(http.MethodPost, integrationStartPath, op, suite.h.StartIntegrationAuth)
+
+	requestCtx := privacy.DecisionContext(echocontext.NewTestEchoContext().Request().Context(), privacy.Allow)
+	user := suite.userBuilderWithInput(requestCtx, &userInput{confirmedUser: true})
+
+	startRec, _ := suite.startIntegrationAuth(t, user.UserCtx, handlers.IntegrationAuthStartRequest{DefinitionID: testAuthDefinitionID})
+	cookies := cookieMap(startRec.Result().Cookies())
+
+	require.Equal(t, "http://console.example/organization-settings/integrations/"+testAuthDefinitionID, cookies["redirect_to"].Value)
+}
+
 func (suite *HandlerTestSuite) TestStartOAuthFlow_MissingProvider() {
 	t := suite.T()
 

internal/integrations/auth/oauth.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"maps"
 	"slices"
 	"time"
@@ -107,7 +108,7 @@ func CompleteOAuth(ctx context.Context, cfg OAuthConfig, state json.RawMessage,
 
 	tokens, err := rp.CodeExchange[*oidc.IDTokenClaims](ctx, code, rparty, mapAuthCodeOptions[rp.CodeExchangeOpt](cfg.TokenParams)...)
 	if err != nil {
-		return OAuthMaterial{}, ErrOAuthCodeExchange
+		return OAuthMaterial{}, fmt.Errorf("%w: %w", ErrOAuthCodeExchange, err)
 	}
 
 	return buildOAuthMaterial(tokens.Token, tokens.IDTokenClaims)
@@ -118,7 +119,7 @@ func buildRelyingParty(ctx context.Context, cfg OAuthConfig) (rp.RelyingParty, e
 	if cfg.DiscoveryURL != "" {
 		rparty, err := rp.NewRelyingPartyOIDC(ctx, cfg.DiscoveryURL, cfg.ClientID, cfg.ClientSecret, cfg.RedirectURL, cfg.Scopes)
 		if err != nil {
-			return nil, ErrOAuthRelyingPartyInit
+			return nil, fmt.Errorf("%w: %w", ErrOAuthRelyingPartyInit, err)
 		}
 
 		return rparty, nil
@@ -137,7 +138,7 @@ func buildRelyingParty(ctx context.Context, cfg OAuthConfig) (rp.RelyingParty, e
 
 	rparty, err := rp.NewRelyingPartyOAuth(oauthCfg)
 	if err != nil {
-		return nil, ErrOAuthRelyingPartyInit
+		return nil, fmt.Errorf("%w: %w", ErrOAuthRelyingPartyInit, err)
 	}
 
 	return rparty, nil

internal/integrations/definitions/azureentraid/config.go

@@ -7,5 +7,5 @@ type Config struct {
 	// ClientSecret is the Azure application client secret used for client credentials auth
 	ClientSecret string `json:"clientsecret" koanf:"clientsecret" sensitive:"true"`
 	// RedirectURL is the OAuth callback URL registered with the Azure application
-	RedirectURL string `json:"redirecturl" koanf:"redirecturl"`
+	RedirectURL string `json:"redirecturl" koanf:"redirecturl" default:"https://api.theopenlane.io/v1/integrations/auth/callback"`
 }

internal/integrations/definitions/googleworkspace/config.go

@@ -7,5 +7,5 @@ type Config struct {
 	// ClientSecret is the Google OAuth application client secret
 	ClientSecret string `json:"clientsecret" koanf:"clientsecret" sensitive:"true"`
 	// RedirectURL is the OAuth callback URL registered with the Google application
-	RedirectURL string `json:"redirecturl" koanf:"redirecturl"`
+	RedirectURL string `json:"redirecturl" koanf:"redirecturl" default:"https://api.theopenlane.io/v1/integrations/auth/callback"`
 }

internal/integrations/definitions/microsoftteams/config.go

@@ -7,5 +7,5 @@ type Config struct {
 	// ClientSecret is the Azure OAuth application client secret
 	ClientSecret string `json:"clientsecret" koanf:"clientsecret" sensitive:"true"`
 	// RedirectURL is the OAuth callback URL registered with the Azure application
-	RedirectURL string `json:"redirecturl" koanf:"redirecturl"`
+	RedirectURL string `json:"redirecturl" koanf:"redirecturl" default:"https://api.theopenlane.io/v1/integrations/auth/callback"`
 }

internal/integrations/definitions/slack/config.go

@@ -7,5 +7,5 @@ type Config struct {
 	// ClientSecret is the Slack OAuth application client secret
 	ClientSecret string `json:"clientsecret" koanf:"clientsecret" sensitive:"true"`
 	// RedirectURL is the OAuth callback URL registered with the Slack application
-	RedirectURL string `json:"redirecturl" koanf:"redirecturl"`
+	RedirectURL string `json:"redirecturl" koanf:"redirecturl" default:"https://api.theopenlane.io/v1/integrations/auth/callback"`
 }