From 4cc0e31214014aa38c49be43fdf6add0eb7fa6e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Mon, 6 Apr 2026 21:11:08 +0200
Subject: [PATCH] Preserve continuation URL on OAuth2 error redirect
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the ContinueURL from the state token so the user is redirected
back to where they initiated the flow instead of the root URL.
The redirect is safe because safeRedirect validates the host.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/server/api/console/v1/resolver.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkg/server/api/console/v1/resolver.go b/pkg/server/api/console/v1/resolver.go
index b2df5f032..fae400bd9 100644
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -268,9 +268,15 @@ func handleConnectorOAuth2Error(
 	oauthErrDesc := query.Get("error_description")
 
 	provider := "unknown"
+	redirectURL := baseURL.String()
 	if stateToken := query.Get("state"); stateToken != "" {
-		if p, err := connector.ExtractProviderFromState(stateToken); err == nil {
-			provider = p
+		if payload, err := connector.DecodeOAuth2StatePayload(stateToken); err == nil {
+			if payload.Data.Provider != "" {
+				provider = payload.Data.Provider
+			}
+			if payload.Data.ContinueURL != "" {
+				redirectURL = payload.Data.ContinueURL
+			}
 		}
 	}
 
@@ -280,7 +286,7 @@ func handleConnectorOAuth2Error(
 		log.String("error_description", oauthErrDesc),
 	)
 
-	parsedURL, _ := url.Parse(baseURL.String())
+	parsedURL, _ := url.Parse(redirectURL)
 	q := parsedURL.Query()
 	q.Set("error", oauthErr)
 	if oauthErrDesc != "" {