Rename redirect-path to continue + handle redirection on forbidden from wrong org assume

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/saml/service.go

@@ -107,7 +107,7 @@ func (s *Service) GenerateSpMetadata() ([]byte, error) {
 func (s *Service) InitiateLogin(
 	ctx context.Context,
 	configID gid.GID,
-	redirectPath string,
+	continuePath string,
 ) (*url.URL, error) {
 	var (
 		now           = time.Now()
@@ -153,7 +153,7 @@ func (s *Service) InitiateLogin(
 				return fmt.Errorf("cannot insert SAML request: %w", err)
 			}
 
-			relayState := config.ID.String() + redirectPath
+			relayState := config.ID.String() + url.QueryEscape(continuePath)
 
 			redirect, err = req.Redirect(relayState, sp)
 			if err != nil {

pkg/iam/session_service.go

@@ -491,7 +491,7 @@ func (s SessionService) AssumeOrganizationSession(
 	ctx context.Context,
 	sessionID gid.GID,
 	organizationID gid.GID,
-	redirectPath string,
+	continueURL string,
 ) (*coredata.Session, *coredata.Membership, error) {
 	var (
 		now          = time.Now()
@@ -549,7 +549,7 @@ func (s SessionService) AssumeOrganizationSession(
 
 			if err == nil && samlConfig.EnforcementPolicy == coredata.SAMLEnforcementPolicyRequired {
 				if rootSession.AuthMethod != coredata.AuthMethodSAML {
-					redirectURL, err := s.SAMLService.InitiateLogin(ctx, samlConfig.ID, redirectPath)
+					redirectURL, err := s.SAMLService.InitiateLogin(ctx, samlConfig.ID, continueURL)
 					if err != nil {
 						return fmt.Errorf("cannot initiate SAML login: %w", err)
 					}