DSpace9/Redirect back to originating page after DiscoJuice local login (#1472)

* Clarin9/Redirect back to originating page after DiscoJuice local login (#876)

On the standalone login page the post-login redirect ignored the `redirectUrl`
query param that the DiscoJuice local-auth flow (src/aai/aai.js) appends as the
absolute page URL, so signing in from e.g. the search page always landed on the
home page. `LogInPasswordComponent.submit()` now reads that query param, reduces
it to an app-relative path (the same format `HardRedirectService.getCurrentRoute()`
produces, which `reloadGuard` already consumes), and uses it as the redirect
target; it prefers a nested `redirectUrl` so login is never the target, and keeps
the previous `setRedirectUrlIfNotSet('/')` fallback when no param is present.

Fixes the dspace-ui-tests LINDAT-013 scenario (loginPage.spec.ts "login from
search page should redirect back to search page"). Mirrors the dtq-dev fix
9dff6af, adapted to the refactored v9 component.

Refs #876

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Clarin9/Trim inline comments in log-in-password redirect fix

Shorten the multiline comments/JSDoc added for the redirect-from-search fix
to one-liners; the fuller rationale now lives in the PR description.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Clarin9/Address Copilot review: harden redirectUrl parsing

- getRedirectUrlFromQueryParams() now returns `string | null` and guards against
  non-string (e.g. repeated `string[]`) query params, so login submission falls
  back to the default redirect instead of throwing.
- Normalize the redirect with a string `.replace(/^https?:\/\/[^/]+/i, '')`
  (v7-style, can't throw) instead of `new URL(...)`.
- Add unit tests for an already-relative redirectUrl and a non-string value.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Matus Kasak <matus.kasak@dataquest.sk>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

src/app/shared/log-in/methods/password/log-in-password.component.spec.ts

@@ -158,6 +158,82 @@ describe('LogInPasswordComponent', () => {
     });
   });
 
+  // Standalone login reads the redirect target from the `redirectUrl` query param (set by aai.js).
+  describe('standalone login redirect (redirectUrl query param)', () => {
+    let authService: AuthServiceStub;
+    let setRedirectUrlSpy: jasmine.Spy;
+    let setRedirectUrlIfNotSetSpy: jasmine.Spy;
+
+    const setQueryParams = (queryParams: Record<string, unknown>) => {
+      (component as any).route = { snapshot: { queryParams } };
+    };
+
+    beforeEach(() => {
+      authService = TestBed.inject(AuthService) as unknown as AuthServiceStub;
+      setRedirectUrlSpy = spyOn(authService, 'setRedirectUrl').and.callThrough();
+      setRedirectUrlIfNotSetSpy = spyOn(authService, 'setRedirectUrlIfNotSet').and.callThrough();
+      // Avoid scheduling the real DiscoJuice popup timer during ngOnInit.
+      spyOn(component as any, 'popUpDiscoJuiceLogin');
+
+      fixture.detectChanges();
+      component.form.controls.email.setValue('user');
+      component.form.controls.password.setValue('password');
+    });
+
+    it('redirects back to the redirectUrl page, reduced to an app-relative path', () => {
+      setQueryParams({ redirectUrl: 'http://dev-6.pc:8603/repository/search' });
+
+      component.submit();
+
+      expect(setRedirectUrlSpy).toHaveBeenCalledWith('/repository/search');
+      expect(setRedirectUrlIfNotSetSpy).not.toHaveBeenCalled();
+    });
+
+    it('keeps the query string of the originating page', () => {
+      setQueryParams({ redirectUrl: 'http://dev-6.pc:8603/repository/search?query=test' });
+
+      component.submit();
+
+      expect(setRedirectUrlSpy).toHaveBeenCalledWith('/repository/search?query=test');
+    });
+
+    it('prefers a nested redirectUrl so the login page is not the redirect target', () => {
+      setQueryParams({
+        redirectUrl: 'http://dev-6.pc:8603/repository/login?redirectUrl=http://dev-6.pc:8603/repository/items/1',
+      });
+
+      component.submit();
+
+      expect(setRedirectUrlSpy).toHaveBeenCalledWith('/repository/items/1');
+    });
+
+    it('passes through an already-relative redirectUrl unchanged', () => {
+      setQueryParams({ redirectUrl: '/repository/search' });
+
+      component.submit();
+
+      expect(setRedirectUrlSpy).toHaveBeenCalledWith('/repository/search');
+    });
+
+    it('falls back to setRedirectUrlIfNotSet("/") when no redirectUrl query param is present', () => {
+      setQueryParams({});
+
+      component.submit();
+
+      expect(setRedirectUrlIfNotSetSpy).toHaveBeenCalledWith('/');
+      expect(setRedirectUrlSpy).not.toHaveBeenCalled();
+    });
+
+    it('falls back cleanly when redirectUrl is not a string (repeated query param)', () => {
+      setQueryParams({ redirectUrl: ['/repository/a', '/repository/b'] });
+
+      component.submit();
+
+      expect(setRedirectUrlIfNotSetSpy).toHaveBeenCalledWith('/');
+      expect(setRedirectUrlSpy).not.toHaveBeenCalled();
+    });
+  });
+
 });
 
 /**

src/app/shared/log-in/methods/password/log-in-password.component.ts

@@ -17,7 +17,10 @@ import {
   UntypedFormGroup,
   Validators,
 } from '@angular/forms';
-import { RouterLink } from '@angular/router';
+import {
+  ActivatedRoute,
+  RouterLink,
+} from '@angular/router';
 import {
   select,
   Store,
@@ -145,6 +148,7 @@ export class LogInPasswordComponent implements OnInit, OnDestroy {
     @Inject('isStandalonePage') public isStandalonePage: boolean,
     private authService: AuthService,
     private hardRedirectService: HardRedirectService,
+    private route: ActivatedRoute,
     private formBuilder: UntypedFormBuilder,
     protected store: Store<CoreState>,
     protected authorizationService: AuthorizationDataService,
@@ -239,7 +243,13 @@ export class LogInPasswordComponent implements OnInit, OnDestroy {
     if (!this.isStandalonePage) {
       this.authService.setRedirectUrl(this.hardRedirectService.getCurrentRoute());
     } else {
-      this.authService.setRedirectUrlIfNotSet('/');
+      // Standalone login: return to the `redirectUrl` query param set by the aai.js local-auth flow.
+      const redirectUrl = this.getRedirectUrlFromQueryParams();
+      if (isNotEmpty(redirectUrl)) {
+        this.authService.setRedirectUrl(redirectUrl);
+      } else {
+        this.authService.setRedirectUrlIfNotSet('/');
+      }
     }
 
     // dispatch AuthenticationAction
@@ -249,6 +259,26 @@ export class LogInPasswordComponent implements OnInit, OnDestroy {
     this.form.reset();
   }
 
+  /** Post-login redirect target from the `redirectUrl` query param (aai.js), as an app-relative path or null. */
+  private getRedirectUrlFromQueryParams(): string | null {
+    // Query params are untyped (can be a string[]); only a non-empty string is usable here.
+    const rawRedirectUrl = this.route.snapshot.queryParams?.redirectUrl;
+    if (typeof rawRedirectUrl !== 'string' || isEmpty(rawRedirectUrl)) {
+      return null;
+    }
+
+    // Prefer a nested `redirectUrl` so login is never the redirect target.
+    const nestedRedirectUrl = new URLSearchParams(rawRedirectUrl.split('?')[1] ?? '').get('redirectUrl');
+    const redirectUrl = isNotEmpty(nestedRedirectUrl) ? nestedRedirectUrl : rawRedirectUrl;
+
+    return this.toRelativePath(redirectUrl);
+  }
+
+  /** Reduce a possibly-absolute URL to an app-relative path by dropping the scheme+host; relative values pass through. */
+  private toRelativePath(url: string): string {
+    return url.replace(/^https?:\/\/[^/]+/i, '');
+  }
+
   /**
    * Toggle Discojuice login. Show it every time except the case when the user click
    * on the `local` button in the discojuice box.