From fcc09d1e4b10e56caec94ea4cc34a9c2f99e7f3f Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sat, 25 Jul 2026 23:55:08 -0400
Subject: [PATCH] logInRedirect: keep the query string on the legacy
 /login/<path> form
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OIDC provider sends an unauthenticated authorize request through
/login/oauth/authorize?client_id=…&state=…; dropping the query there
loses the whole authorization request. The ?redirect= form is unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 nodejs/public/lib/js/app-base.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nodejs/public/lib/js/app-base.js b/nodejs/public/lib/js/app-base.js
index d5fff48..7aa874d 100644
--- a/nodejs/public/lib/js/app-base.js
+++ b/nodejs/public/lib/js/app-base.js
@@ -379,11 +379,13 @@ app.auth = (function(app){
 	}
 
 	// Where to go after a successful login: the ?redirect= query param, or the
-	// legacy /login/<path> suffix form, constrained to a same-origin path.
+	// legacy /login/<path> suffix form, constrained to a same-origin path. The
+	// suffix form keeps its query string — /login/oauth/authorize?client_id=…
+	// is how the OIDC provider sends an unauthenticated user through login.
 	function logInRedirect(){
 		var params = new URLSearchParams(location.search);
 		var target = params.get('redirect')
-			|| location.href.replace(location.origin + '/login', '').split('?')[0]
+			|| location.href.replace(location.origin + '/login', '')
 			|| '/';
 		window.location.href = safeInternalPath(target);
 	}