From 438c0b976140a2d2657e874b234368832e88359d Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 00:15:31 +0200 Subject: [PATCH] fix: reserve /oauth for social sign-in The SPA fallback no longer answers /oauth and the paths below it with index.html, so golem15.sociallogin's start and provider callback routes reach the backend; /oauthy is still a client route. --- static.go | 7 ++++--- static_test.go | 3 ++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/static.go b/static.go index 9e35f8f..0aaae6b 100644 --- a/static.go +++ b/static.go @@ -37,9 +37,10 @@ const ( const defaultAdminPath = "/bmadmin" // reservedPrefixes are the path prefixes the student app never answers: the -// APIs of the plugins and the public uploads. The admin path is added from -// the configuration. -var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/api", "/storage"} +// APIs of the plugins, the public uploads and /oauth (the social sign-in +// routes of golem15.sociallogin and their provider callbacks). The admin +// path is added from the configuration. +var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/api", "/storage", "/oauth"} // errMissingIndex reports a tree without index.html (an unbuilt tree). var errMissingIndex = errors.New("jz.bm: public/index.html missing; run the frontend build (cd frontend && npm ci && npm run build)") diff --git a/static_test.go b/static_test.go index 78f9b48..6c3fffc 100644 --- a/static_test.go +++ b/static_test.go @@ -116,6 +116,7 @@ func TestStaticReservedPaths(t *testing.T) { "/_presentations", "/_presentations/api/v1/nope", "/bmadmin", "/bmadmin/", "/bmadmin/login", "/storage/app/uploads/public/x.pdf", "/storage", "/_user/../_user/x", "//_bm/api", + "/oauth", "/oauth/microsoft", "/oauth/microsoft/callback", } { rec := get(h, http.MethodGet, p, nil) if rec.Code != http.StatusNotFound || strings.Contains(rec.Body.String(), "app") { @@ -123,7 +124,7 @@ func TestStaticReservedPaths(t *testing.T) { } } // Names that merely start like a reserved prefix are client routes. - for _, p := range []string{"/bmadmins", "/storage-info", "/_users"} { + for _, p := range []string{"/bmadmins", "/storage-info", "/_users", "/oauthy"} { if rec := get(h, http.MethodGet, p, nil); rec.Code != http.StatusOK { t.Fatalf("GET %s = %d, want the fallback", p, rec.Code) }