ZCU-DATA/fix: absolute reload URL and no post-login hard redirect during SSR

Fixes the redirect loop after a Shibboleth login:

- navigateToRedirectUrl() and refreshAfterChangeLanguage() build an absolute,
  ui.nameSpace-aware /reload/<ts> URL. A relative 'reload/<ts>' URL in the
  Location header is resolved against the request URL (e.g.
  /bitstreams/<uuid>/download after an external login), producing nested
  /bitstreams/<uuid>/reload/... URLs which never match the top-level
  'reload/:rnd' route. navigateToRedirectUrl() also skips the redirect when
  the current path already is the reload page.
- authenticatedSuccess$ dispatches RedirectAfterLoginSuccess only in the
  browser. The server cannot clear the dsRedirectUrl cookie
  (ServerCookieService.set/remove are no-ops), so a hard redirect during SSR
  repeats on every request - one 'reload/' segment per 302 hop - until the
  browser aborts at its redirect limit.
- ServerHardRedirectService.redirect() never emits a relative Location header.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: milanmajchrak

src/app/core/auth/auth.effects.ts

@@ -1,4 +1,5 @@
-import { Injectable, NgZone } from '@angular/core';
+import { Inject, Injectable, NgZone, PLATFORM_ID } from '@angular/core';
+import { isPlatformBrowser } from '@angular/common';
 
 import {
   asyncScheduler,
@@ -100,7 +101,11 @@ export class AuthEffects {
       map((redirectUrl: string) => [action, redirectUrl])
     )),
     map(([action, redirectUrl]: [AuthenticatedSuccessAction, string]) => {
-      if (hasValue(redirectUrl)) {
+      // Perform the redirect only in the browser: the server cannot clear the redirect cookie
+      // (ServerCookieService.set/remove are no-ops), so a hard redirect during SSR would repeat
+      // on every request and create a redirect loop.
+      // The browser re-runs this effect after hydration and performs the redirect itself.
+      if (hasValue(redirectUrl) && isPlatformBrowser(this.platformId)) {
         return new RedirectAfterLoginSuccessAction(redirectUrl);
       } else {
         return new RetrieveAuthenticatedEpersonAction(action.payload.userHref);
@@ -287,6 +292,7 @@ export class AuthEffects {
               private zone: NgZone,
               private authorizationsService: AuthorizationDataService,
               private authService: AuthService,
-              private store: Store<AppState>) {
+              private store: Store<AppState>,
+              @Inject(PLATFORM_ID) private platformId: any) {
   }
 }

src/app/core/auth/auth.service.ts

@@ -487,9 +487,21 @@ export class AuthService {
    * @param redirectUrl
    */
   public navigateToRedirectUrl(redirectUrl: string) {
+    // Don't do redirect if the current page already is the reload page,
+    // otherwise the reload could be repeated indefinitely
+    // (only the path is checked - a query string could legitimately contain '/reload/')
+    const currentRoute = this.hardRedirectService.getCurrentRoute();
+    if (hasValue(currentRoute) && currentRoute.split('?')[0].includes('/reload/')) {
+      return;
+    }
     // Don't do redirect if already on reload url
     if (!hasValue(redirectUrl) || !redirectUrl.includes('reload/')) {
-      let url = `reload/${new Date().getTime()}`;
+      // The reload URL must be absolute (nameSpace-aware). A relative 'reload/...' URL is resolved
+      // against the current URL - e.g. against /bitstreams/<uuid>/download after an external
+      // (Shibboleth) login - and produces invalid nested URLs like /bitstreams/<uuid>/reload/...
+      // which never match the 'reload/:rnd' route.
+      const nameSpace = (environment.ui.nameSpace || '').replace(/\/$/, '');
+      let url = `${nameSpace}/reload/${new Date().getTime()}`;
       if (isNotEmpty(redirectUrl) && !redirectUrl.startsWith(LOGIN_ROUTE)) {
         url += `?redirect=${encodeURIComponent(redirectUrl)}`;
       }

src/app/core/locale/locale.service.ts

@@ -191,8 +191,13 @@ export class LocaleService {
   public refreshAfterChangeLanguage() {
     this.routeService.getCurrentUrl().pipe(take(1)).subscribe((currentURL) => {
       // Hard redirect to the reload page with a unique number behind it
-      // so that all state is definitely lost
-      this._window.nativeWindow.location.href = `reload/${new Date().getTime()}?redirect=` + encodeURIComponent(currentURL);
+      // so that all state is definitely lost.
+      // The reload URL must be absolute (nameSpace-aware). A relative 'reload/...' URL is resolved
+      // against the current URL and produces invalid nested URLs like /items/<uuid>/reload/...
+      // which never match the 'reload/:rnd' route.
+      const nameSpace = (environment.ui.nameSpace || '').replace(/\/$/, '');
+      this._window.nativeWindow.location.href =
+        `${nameSpace}/reload/${new Date().getTime()}?redirect=` + encodeURIComponent(currentURL);
     });
 
   }

src/app/core/services/server-hard-redirect.service.ts

@@ -26,6 +26,13 @@ export class ServerHardRedirectService extends HardRedirectService {
    */
   redirect(url: string, statusCode?: number) {
 
+    // A relative URL in the Location header is resolved by the browser against the request URL
+    // (e.g. 'reload/123' requested at /bitstreams/<uuid>/download resolves to
+    // /bitstreams/<uuid>/reload/123) - make sure only absolute URLs are emitted
+    if (!url.startsWith('/') && !/^https?:\/\//i.test(url)) {
+      url = '/' + url;
+    }
+
     if (url === this.req.url) {
       return;
     }