The resource auth login page (auth/resource/[resourceGuid]) loads IdPs via
the global /idp list in the non-saas/non-org path and passed idp.type as the
icon variant. Since type is always 'oidc' for OIDC-backed providers (Google,
Azure), the branded logos were never selected, showing the generic OIDC icon
instead.
Use idp.variant (with type as fallback), matching the fix already applied to
the main login page (auth/login) and org login page (auth/org/[orgId]).
Fixes#3631
The resource auth page copies the redirect query parameter into
redirectUrl when its host matches the resource host
(src/app/auth/resource/[resourceGuid]/page.tsx:121-150). URL parses a
host out of every scheme that uses "//", so a target such as
javascript://resource-host/... passes that comparison. The value is
handed to ResourceAuthPortal as the redirect prop and assigned to
window.location.href after a successful login
(src/components/ResourceAuthPortal.tsx:213,247,281).
Parse the target once and require http: or https: before the host
comparisons. The three branches that assigned the same value are folded
into one condition; the accepted set of http(s) targets is unchanged.
Resolve conflicts against upstream's refactors:
- server/db/sqlite/schema/schema.ts: adopt upstream's reindented
sqliteTable(name, cols, indexes) form for sites/resources, re-applying
the headers -> requestHeaders/responseHeaders split. Kept in sync with
the Postgres schema.
- server/lib/traefik/headersMiddleware.ts: extend upstream's extracted
buildCustomHeadersMiddleware helper to take requestHeaders and
responseHeaders and emit both customRequestHeaders and
customResponseHeaders.
- server/lib/traefik/getTraefikConfig.ts and
server/private/lib/traefik/getTraefikConfig.ts: keep upstream's helper
extraction and appendPathMatch refactor, dropping the superseded inline
blocks.
Also carry the feature forward onto code that moved upstream:
- The resource settings UI moved from resources/proxy/[niceId]/proxy to
resources/public/[niceId]/http, which dropped this branch's changes in
the previous merge. Re-add the request/response header inputs there and
rename the vestigial headers field on the tcp page.
- messages/da-DK.json is new upstream and still had the old customHeaders
key; rename it in line with the other locales.
Per the contributing docs, versioned migrations are intentionally omitted
so maintainers can write them at release time.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Owen