Enhance SAML authentication and preserve contest invite paths - #222
Merged
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
- Update `after_sign_in_path_for` to prioritize SAML RelayState and omniauth.origin for redirecting users post-login. - Implement `saml_preserved_return_path` and `safe_internal_redirect_path` methods to manage return paths securely. - Modify `ContestInvitesController` to store the invite path for unauthenticated users and redirect them to login with an alert. - Update views to pass `saml_authorize_params` for SAML login links. - Add tests for new authentication logic and contest invite behavior. This commit improves user experience by preserving intended navigation paths during SAML authentication.
There was a problem hiding this comment.
Pull request overview
This PR improves post-authentication redirection for SAML logins (preserving deep links like private contest invite URLs through SAML round-trips) and refines the contest-invite flow for unauthenticated users and users who must create a profile before redeeming an invite.
Changes:
- Updated
ApplicationController#after_sign_in_path_forto prefer SAMLRelayState/omniauth.origin, with internal-path validation to mitigate open redirects. - Updated contest-invite handling to store the intended invite URL for unauthenticated users and to persist/consume a pending invite token across profile creation.
- Added controller specs covering the new redirect and invite/profile flows.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| spec/controllers/profiles_controller_spec.rb | Adds coverage ensuring profile creation returns users to a pending contest invite when applicable. |
| spec/controllers/contest_invites_controller_spec.rb | Adds coverage for storing return location when signed out and for session persistence when profile is missing. |
| spec/controllers/application_controller_spec.rb | Adds coverage for after_sign_in_path_for precedence (RelayState/origin/stored location) and open-redirect protections. |
| config/initializers/devise.rb | Configures SAML runtime params intended to carry post-login destination via RelayState. |
| app/views/static_pages/home.html.erb | Passes origin params into the SAML authorize request to preserve deep links. |
| app/views/devise/shared/_links.html.erb | Passes origin params into omniauth authorize buttons consistently. |
| app/helpers/application_helper.rb | Introduces saml_authorize_params helper to supply origin based on stored Devise return path. |
| app/controllers/profiles_controller.rb | Redirects to the pending invite (if present) after successful profile creation. |
| app/controllers/contest_invites_controller.rb | Allows unauthenticated access to show and stores intended destination / remembers pending invite token for profile creation. |
| app/controllers/concerns/contest_invite_session.rb | Adds session helpers to remember/consume a pending contest invite token. |
| app/controllers/application_controller.rb | Implements SAML-aware post-login redirection with safe internal redirect validation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request enhances the authentication and contest invitation flow, especially for users accessing private contest links via SAML login. It ensures users are redirected to the correct destination after authentication, even when session data is lost during SAML round-trips. It also improves the handling of pending contest invites for users who must create a profile before accessing a contest. Comprehensive tests are added to verify these scenarios.
Authentication and SAML login improvements:
after_sign_in_path_forinApplicationControllerto prefer SAMLRelayStateandomniauth.originfor post-login redirection, ensuring deep links (like private contest invites) are preserved through SAML authentication. Added robust path validation to prevent open redirects.RelayStateby updating the SAML button helpers and Devise configuration (idp_sso_service_url_runtime_params). [1] [2] [3] [4]Contest invite and profile creation flow:
ContestInvitesControllerto redirect unauthenticated users to login and store the intended invite path for redirect after authentication. For users without profiles, the contest invite token is saved in the session and used to return the user to the invite after profile creation. [1] [2] [3] [4] [5] [6]Testing and validation:
ApplicationController,ContestInvitesController, andProfilesController, covering SAML RelayState, pending contest invites, and security checks. [1] [2] [3] [4]