fix(auth): avoid disabled UI OAuth redirects

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

src/EventStore.ClusterNode/Components/Pages/SignIn.razor

@@ -110,6 +110,7 @@
 	private SecurityAuthenticationInfo Authentication { get; set; } = SecurityAuthenticationInfo.Unavailable();
 	private bool AuthenticationAvailable { get; set; } = true;
 	private string Message { get; set; } = "";
+	private string DisplayedOAuthError { get; set; } = "";
 	private string Destination => SecurityBrowserService.NormalizeReturnUrl(ReturnUrl);
 
 	protected override void OnParametersSet() {
@@ -118,12 +119,19 @@
 		try {
 			Authentication = Security.AuthenticationInfo();
 			AuthenticationAvailable = true;
-			Message = string.IsNullOrWhiteSpace(OAuthError)
-				? ""
-				: OAuthErrorMessage(OAuthError);
+			if (string.IsNullOrWhiteSpace(OAuthError)) {
+				if (!string.IsNullOrWhiteSpace(DisplayedOAuthError)) {
+					Message = "";
+					DisplayedOAuthError = "";
+				}
+			} else {
+				Message = OAuthErrorMessage(OAuthError);
+				DisplayedOAuthError = OAuthError;
+			}
 		} catch (Exception ex) {
 			Authentication = SecurityAuthenticationInfo.Unavailable();
 			AuthenticationAvailable = false;
+			DisplayedOAuthError = "";
 			Message = $"Unable to load authentication information: {UserInterfaceMessages.Friendly(ex)}";
 		}
 
@@ -153,22 +161,26 @@
 		try {
 			var result = await Security.Validate(Input.Username, Input.Password);
 			if (!result.Success) {
+				DisplayedOAuthError = "";
 				Message = result.Message;
 				return;
 			}
 
 			var context = HttpContextAccessor.HttpContext;
 			if (context is null) {
+				DisplayedOAuthError = "";
 				Message = "The sign-in response is no longer available.";
 				return;
 			}
 
 			UiCredentialCookie.DeleteOAuthToken(context.Response);
 			UiCredentialCookie.AppendBasic(context.Response, new UiCredentials(Input.Username.Trim(), Input.Password));
 		} catch (OperationCanceledException) {
+			DisplayedOAuthError = "";
 			Message = "Sign-in was canceled.";
 			return;
 		} catch (Exception ex) {
+			DisplayedOAuthError = "";
 			Message = $"Failed to sign in: {UserInterfaceMessages.Friendly(ex)}";
 			return;
 		}

src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs

@@ -239,7 +239,9 @@ private static string SignInLocation(string returnUrl) =>
 			: $"/ui/signin?returnUrl={Uri.EscapeDataString(returnUrl)}";
 
 	private static string DirectReturnLocation(string returnUrl) =>
-		string.IsNullOrWhiteSpace(returnUrl) || returnUrl == "/ui"
+		string.IsNullOrWhiteSpace(returnUrl) ||
+		returnUrl.Equals("/ui", StringComparison.OrdinalIgnoreCase) ||
+		returnUrl.StartsWith("/ui/", StringComparison.OrdinalIgnoreCase)
 			? "/"
 			: returnUrl;
 

src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs

@@ -84,7 +84,7 @@ public async Task callback_redirects_to_return_url_when_admin_ui_is_disabled()
 		await result.ExecuteAsync(context);
 
 		Assert.AreEqual(HttpStatusCode.Redirect, (HttpStatusCode)context.Response.StatusCode);
-		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/ui/streams"));
+		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/"));
 		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Contain($"{UiCredentialCookie.OAuthCookieName}=access-token"));
 	}
 
@@ -152,7 +152,7 @@ public async Task callback_with_provider_error_redirects_to_return_url_when_admi
 		await result.ExecuteAsync(context);
 
 		Assert.AreEqual(HttpStatusCode.Redirect, (HttpStatusCode)context.Response.StatusCode);
-		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/ui/streams?oauth_error=provider_error"));
+		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/?oauth_error=provider_error"));
 		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Not.Contain($"{UiCredentialCookie.OAuthCookieName}=access-token"));
 		Assert.That(handler.Body, Is.Empty);
 	}