Merge pull request #4020 from 2748109647/fix/4010-preserve-absolute-pac4j-urls

pac4j: preserve absolute URLs in URL resolver

Author: jknack

modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/UrlResolverImpl.java

@@ -32,9 +32,11 @@ public String compute(String url, WebContext context) {
 
       return url;
     }
-    // Rewrite using context which might uses trust proxy setting.
-    var path = absoluteURL ? URI.create(url).getPath() : url;
-    var requestURL = ((Pac4jContext) context).getContext().getRequestURL(path);
+    if (absoluteURL) {
+      return url;
+    }
+    // Resolve relative URLs using the context, which might use trust proxy settings.
+    var requestURL = ((Pac4jContext) context).getContext().getRequestURL(url);
     // no query String
     int i = requestURL.indexOf('?');
     return i > 0 ? requestURL.substring(0, i) : requestURL;

modules/jooby-pac4j/src/test/java/io/jooby/internal/pac4j/UrlResolverImplTest.java

@@ -0,0 +1,48 @@
+/*
+ * Jooby https://jooby.io
+ * Apache License Version 2.0 https://jooby.io/LICENSE.txt
+ * Copyright 2014 Edgar Espina
+ */
+package io.jooby.internal.pac4j;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import io.jooby.Context;
+import io.jooby.pac4j.Pac4jContext;
+
+@ExtendWith(MockitoExtension.class)
+class UrlResolverImplTest {
+
+  @Mock private Pac4jContext pac4jContext;
+  @Mock private Context joobyContext;
+
+  @Test
+  void shouldPreserveAbsoluteExternalUrlWithQuery() {
+    String url = "https://www.casserverpac4j.dev/login?locale=fr";
+    String callbackUrl = "https://app.example.org/callback?client_name=CasClient";
+    UrlResolverImpl resolver = new UrlResolverImpl();
+
+    assertEquals(url, resolver.compute(url, pac4jContext));
+    assertEquals(callbackUrl, resolver.compute(callbackUrl, pac4jContext));
+
+    verifyNoInteractions(pac4jContext, joobyContext);
+  }
+
+  @Test
+  void shouldResolveRelativeUrlUsingContext() {
+    when(pac4jContext.getContext()).thenReturn(joobyContext);
+    when(joobyContext.getRequestURL("/callback"))
+        .thenReturn("https://example.org/callback?ignored=true");
+
+    assertEquals(
+        "https://example.org/callback",
+        new UrlResolverImpl().compute("/callback", pac4jContext));
+  }
+}