mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-25 04:33:03 +00:00
courtmanr@gmail.com
a92825b9db
The SSO settings panel presents the OIDC Callback / Redirect URL and the SAML SP metadata and ACS URLs as the values to register with an Identity Provider. When PULSE_PUBLIC_URL was unset, providerToResponse built them on a hardcoded http://localhost:7655, so an admin copied a localhost URL into their IdP and got an opaque failure there with nothing pointing back at Pulse as the cause. The base URL is now resolved from the configured public URL when set — still authoritative — and otherwise from the inbound request, which by construction arrived over an address that reaches Pulse. This follows the pattern buildSSOOIDCCallbackURL already used for the live OIDC login flow, and the frontend already used for the SAML SP metadata preview (window.location.origin). The scheme/host derivation is factored out of that builder into requestForwardedScheme, requestForwardedHost and requestOriginBaseURL on router.go, so forwarded headers stay behind the same trusted-proxy gate; buildSSOOIDCCallbackURL's output is unchanged. When neither source resolves a host the fields are now omitted rather than carrying a wrong absolute URL. The panel renders guidance pointing at the public URL setting instead of a copy button, for both the OIDC and the SAML blocks. The add-provider modal also no longer claims the URL will be "shown here" after save — the modal closes on save, so it now says to copy it from the provider card. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>