danhaywood opened a new pull request, #3878: URL: https://github.com/apache/causeway/pull/3878
## Problem When the Wicket viewer is behind external authentication (Spring Security OAuth2/OIDC, a pre-authenticating proxy, or Keycloak), a user who follows a deep link such as `/wicket/entity/<logicalType>:<id>` from an email always lands on the home page. The same happens when the session has expired and the next request re-authenticates without the user noticing. The requested URL makes it through external authentication; the Wicket viewer then drops it: 1. `WebRequestCycleForCauseway.onBeginRequest` only signs in the Wicket session from the external `InteractionContext` if a Wicket `Session` already exists. On the first request of a new session, the `@AuthorizeInstantiation` check therefore fails, and Wicket redirects to the sign-in page, saving the requested URL as the original destination. 2. On the next request the session is signed in, and the `WicketSignInPage` constructor always calls `restartAt(HOME)`, ignoring that saved destination. ## Fix In `WicketSignInPage`, when the session is already signed in, call `continueToOriginalDestination()` before falling back to `restartAt(HOME)`. The fallback to the home page still applies when: - the sign-in page is reporting an exception, which prevents a redirect loop if the original page is the one that failed, or - `causeway.viewer.wicket.clear-original-destination` is set. Interactive (username/password) sign-in is unchanged. ## Tests `WicketSignInPageOriginalDestinationTest` (in `viewers/wicket/ui-test`) uses WicketTester with stub pages to replay the intercept-then-signed-in request sequence. The deep-link test failed before the fix and passes after it. The other three tests check that the home page is still used when there is no saved destination, when the clear setting is on, and when an exception is being reported. The `viewers/wicket` ui-test (117 tests) and viewer (17 tests) suites pass. ## Not yet done Checking this by hand in a consuming app (Estatio) for both the deep-link and the session-expiry cases. These are tasks 4.1 and 4.2 in the OpenSpec change `openspec/changes/wicket-deep-link-after-sso/`, which also holds the proposal, design and spec. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
