mirror of
https://github.com/fosrl/pangolin.git
synced 2026-07-20 00:50:56 -05:00
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#22545
Reference in New Issue
Block a user
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3200
Author: @Adityakk9031
Created: 6/1/2026
Status: 🔄 Open
Base:
dev← Head:#3001📝 Commits (1)
35d16acfix: redirect lost after Pangolin auth session timeout (#3001)📊 Changes
3 files changed (+61 additions, -4 deletions)
View changed files
📝
messages/en-US.json(+3 -0)📝
src/app/auth/resource/[resourceGuid]/page.tsx(+2 -0)📝
src/components/OrgPolicyRequired.tsx(+56 -4)📄 Description
Problem
When a user's Pangolin session expires (org maxSessionLengthHours policy) and they visit a protected resource, they are correctly redirected to /auth/resource/{guid}?redirect=https://myservice.mydomain.com. However, after re-authenticating, they stay on pangolin.mydomain.com instead of being sent to myservice.mydomain.com.
It only works correctly if the user manually logs out first.
Root Cause
In src/app/auth/resource/[resourceGuid]/page.tsx, redirectUrl is correctly computed from the ?redirect query param. But when the org policy check fails (maxSessionLength.compliant = false), the page renders without passing redirectUrl. That component had a hardcoded button sending the user to the Pangolin dashboard — the redirect was permanently lost.
Fix
page.tsx — constructs resourceAuthPageUrl (the resource auth page with the ?redirect param preserved) and passes it as redirectAfterAuth to
OrgPolicyRequired.tsx — detects maxSessionLength policy failure and renders a dedicated "Session Expired" card with a "Re-authenticate" button that calls POST /auth/logout then navigates back to the resource auth page. Without a session, the page shows the login form and after login correctly redirects to the original resource
en-US.json — adds sessionExpired, sessionExpiredReauthRequired, and reauthenticate translation keys
Fixed Flow
Session expired → visit myservice.mydomain.com
→ /auth/resource/{guid}?redirect=https://myservice.mydomain.com
→ "Session Expired" card shown
→ click "Re-authenticate"
→ logout + navigate back to /auth/resource/{guid}?redirect=https://myservice.mydomain.com
→ login form shown (no session now)
→ login → redirected to https://myservice.mydomain.com ✓
Files Changed
src/app/auth/resource/[resourceGuid]/page.tsx
src/components/OrgPolicyRequired.tsx
messages/en-US.json
Fixes
Closes #3001
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.