[arnabnandy7]

Fixes #2685

What

Resolve the configured oauth2RedirectUrl against the Swagger UI page URL using the browser URL API.

The existing sentinel value is left unchanged when no redirect URL is configured.

Why

Integrations can now supply a page-relative OAuth redirect URL. When Swagger UI is accessed through a reverse proxy that strips an external path prefix, resolving the URL against window.location.href preserves that externally visible prefix.

Absolute URLs continue to work unchanged.

Testing

mvn -pl ui/open-api-ui -Dtest=IndexCreatorTest test

[MikeEdgar]

@arnabnandy7, question on the changed condition. @phillip-kruger is this what you had in mind for the template change?

[phillip-kruger]

Thanks @arnabnandy7, yes @MikeEdgar, this is what I had in mind. Resolving against window.location.href keeps absolute paths and full URLs working as before, makes page-relative values keep a proxy prefix, and also fixes protocol-relative values (//host/x), which used to become http://host//host/x.

The "-" guard is needed: IndexHtmlCreator.replace() substitutes "-" when no redirect URL is configured, and without the guard that would turn into <page>/-.

A few small things:

1. Comment in the template. The "-" depends on a value set in another file. A short comment would answer the question for the next reader, for example // Resolve against the page URL ("-" means not configured, see IndexHtmlCreator).
2. Keep a test for the default case. testOauth2RedirectReplacement used to cover the unconfigured case and now only covers the configured one. Please add a test that the default still renders var oar = "-"; together with the guard.
3. Optional: guard against a value new URL can't parse. If a configured value can't be parsed, new URL throws inside window.onload and the whole UI fails to render, where before the value was passed through as is. A try { ... } catch (e) {} that keeps the raw value would avoid that.

For Quarkus: once this is released, Quarkus can pass the relative oauth2-redirect.html instead of swaggerUiPath + "/oauth2-redirect.html" (follow-up to quarkusio/quarkus#56953), and the OAuth flow will then work behind a prefix.

[phillip-kruger]

The resolution logic looks good. I checked page-relative, root-relative, protocol-relative and absolute values against a prefixed page URL, and all resolve as expected. Before merging, please pick up the points from my earlier comment. The PR still has only the original commit:

1. Add a short comment in the template explaining the "-" sentinel.
2. Add a test for the unconfigured case (var oar = "-"; plus the guard).
3. Optional: wrap new URL in a try/catch so a value it can't parse doesn't stop the UI from rendering.

[phillip-kruger]

Thanks!

[MikeEdgar]

@arnabnandy7 are you planning any other changes to this PR? I think we are good to go ahead and merge, but I just want to double check before doing so.

[arnabnandy7]

@arnabnandy7 are you planning any other changes to this PR? I think we are good to go ahead and merge, but I just want to double check before doing so.

@MikeEdgar no I don't intend to make any other changes, unless suggested otherwise.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud