4c6a345d60
When connecting a Gmail or Outlook inbox during onboarding, the OAuth flow used to drop users in inbox settings, breaking onboarding. The OAuth start endpoint now accepts an optional `return_to=onboarding` hint, carried tamper-proof inside the signed `state`, and the callback uses it to return the user to the onboarding inbox-setup screen. Without the hint, behavior is unchanged. This is the backend half only; the frontend that sends `return_to=onboarding` ships separately. Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
32 lines
860 B
Ruby
32 lines
860 B
Ruby
class Api::V1::Accounts::OauthAuthorizationController < Api::V1::Accounts::BaseController
|
|
before_action :check_authorization
|
|
|
|
protected
|
|
|
|
def scope
|
|
''
|
|
end
|
|
|
|
def state
|
|
# The sgid purpose doubles as a return hint: onboarding tags it so the callback
|
|
# can route the user back to inbox setup. The purpose is part of the signed
|
|
# payload (tamper-proof), and a non-onboarding request keeps the default
|
|
# purpose, leaving callers like Notion byte-identical.
|
|
Current.account.to_sgid(expires_in: 15.minutes, for: state_purpose).to_s
|
|
end
|
|
|
|
def state_purpose
|
|
params[:return_to] == 'onboarding' ? 'onboarding' : 'default'
|
|
end
|
|
|
|
def base_url
|
|
ENV.fetch('FRONTEND_URL', 'http://localhost:3000')
|
|
end
|
|
|
|
private
|
|
|
|
def check_authorization
|
|
raise Pundit::NotAuthorizedError unless Current.account_user.administrator?
|
|
end
|
|
end
|