diff --git a/app/Http/Controllers/TenantAdminGoogleController.php b/app/Http/Controllers/TenantAdminGoogleController.php index 06d5a67..f15707e 100644 --- a/app/Http/Controllers/TenantAdminGoogleController.php +++ b/app/Http/Controllers/TenantAdminGoogleController.php @@ -57,6 +57,7 @@ class TenantAdminGoogleController extends Controller Auth::login($user, true); $request->session()->regenerate(); + $request->session()->forget('url.intended'); $returnTo = $request->session()->pull('tenant_oauth_return_to'); if (is_string($returnTo)) { @@ -66,7 +67,12 @@ class TenantAdminGoogleController extends Controller } } - return redirect()->intended('/event-admin/dashboard'); + $fallback = $request->session()->pull('tenant_admin.return_to'); + if (is_string($fallback) && str_starts_with($fallback, '/event-admin')) { + return redirect()->to($fallback); + } + + return redirect()->to('/event-admin/dashboard'); } private function sendBackWithError(Request $request, string $code, string $message): RedirectResponse diff --git a/tests/Feature/Auth/TenantAdminGoogleControllerTest.php b/tests/Feature/Auth/TenantAdminGoogleControllerTest.php index f1d9008..e151f2c 100644 --- a/tests/Feature/Auth/TenantAdminGoogleControllerTest.php +++ b/tests/Feature/Auth/TenantAdminGoogleControllerTest.php @@ -69,6 +69,34 @@ class TenantAdminGoogleControllerTest extends TestCase $this->assertAuthenticatedAs($user); } + public function test_callback_ignores_intended_and_uses_admin_fallback(): void + { + $tenant = Tenant::factory()->create(); + $user = User::factory()->create([ + 'tenant_id' => $tenant->id, + 'role' => 'tenant_admin', + ]); + + $socialiteUser = tap(new SocialiteUser)->map([ + 'id' => 'google-id-456', + 'name' => 'Google Tenant Admin', + 'email' => $user->email, + ]); + + $driver = Mockery::mock(); + Socialite::shouldReceive('driver')->once()->with('google')->andReturn($driver); + $driver->shouldReceive('user')->once()->andReturn($socialiteUser); + + $this->withSession([ + 'url.intended' => '/packages', + ]); + + $response = $this->get('/event-admin/auth/google/callback'); + + $response->assertRedirect('/event-admin/dashboard'); + $this->assertAuthenticatedAs($user); + } + public function test_callback_redirects_back_when_user_not_found(): void { $socialiteUser = tap(new SocialiteUser)->map([