fix(oauth2): emit legacy redirect_uri (?id=) + b2clogin path rewrite

External IdP app registrations pin the exact redirect_uri the auth
service sends. The legacy Ruby service (generic_oauth#callback_url) sends
.../auth/oauth2/callback?id=<strat>, and its RewriteRedirectResponse
middleware rewrites that to the path form .../auth/oauth2/callback/<strat>
for *.b2clogin.com hosts (Azure B2C won't round-trip a query string on
redirect_uri). auth.cr was sending a bare .../callback with no id, which
every external IdP would reject as an unregistered redirect_uri, and the
strat id never round-tripped.

- callback_uri now carries ?id=<strat>, byte-identical to the legacy URL,
  used for both the authorize redirect and the token exchange.
- Add rewrite_b2clogin_redirect to convert the authorize redirect's
  encoded redirect_uri to the path form for *.b2clogin.com hosts,
  mirroring RewriteRedirectResponse. The inbound path form was already
  handled by the callback_alias route (RewriteCallbackRequest equivalent).

This makes external OAuth2 SSO a true drop-in: no IdP re-registration.

Author: chillfox

spec/controllers/provider_callbacks_spec.cr

@@ -105,6 +105,70 @@ module PlaceOS::Auth
       end
     end
 
+    # ---- redirect_uri parity (drop-in) ------------------------------
+
+    # The legacy Ruby service (generic_oauth#callback_url) sends
+    # `redirect_uri = <host>/auth/oauth2/callback?id=<strat>` to the IdP,
+    # and its RewriteRedirectResponse middleware rewrites that to the
+    # path form `<host>/auth/oauth2/callback/<strat>` for `*.b2clogin.com`
+    # hosts (B2C won't round-trip a query string on redirect_uri). These
+    # URLs are registered in external IdPs and cannot change, so auth.cr
+    # must emit them byte-for-byte.
+    describe "redirect_uri parity", tags: "oauth-redirect-uri" do
+      it "sends redirect_uri carrying ?id=<strat> (matches legacy)" do
+        strat = create_strat.call("https://idp.example.test", "openid")
+        result = client.get(
+          "/auth/oauth2?id=#{URI.encode_www_form(strat.id.as(String))}",
+          headers: HTTP::Headers{"Host" => "localhost"},
+        )
+        result.status_code.should eq 303
+        location = result.headers["Location"]
+        params = URI::Params.parse(location.split('?', 2).last)
+        params["redirect_uri"].should eq "http://localhost/auth/oauth2/callback?id=#{strat.id}"
+      ensure
+        strat.try &.destroy
+      end
+
+      it "rewrites redirect_uri to the path form for *.b2clogin.com hosts" do
+        strat = create_strat.call("https://org.b2clogin.com", "openid")
+        result = client.get(
+          "/auth/oauth2?id=#{URI.encode_www_form(strat.id.as(String))}",
+          headers: HTTP::Headers{"Host" => "localhost"},
+        )
+        result.status_code.should eq 303
+        location = result.headers["Location"]
+        location.should start_with "https://org.b2clogin.com/authorize?"
+        params = URI::Params.parse(location.split('?', 2).last)
+        params["redirect_uri"].should eq "http://localhost/auth/oauth2/callback/#{strat.id}"
+      ensure
+        strat.try &.destroy
+      end
+
+      it "accepts the path-form callback and completes the round-trip" do
+        strat = create_strat.call("https://idp.example.test", "openid email")
+        stub_token_endpoint.call("https://idp.example.test", "idp-token-xyz")
+        stub_userinfo.call("https://idp.example.test", {
+          "id"    => "idp-uid-#{Random.rand(99999)}",
+          "email" => "bob-#{Random.rand(99999)}@localhost",
+          "name"  => "Bob Barker",
+        })
+
+        kickoff_data = kickoff.call(strat.id.as(String))
+
+        # IdP returns via the path-form callback (B2C style).
+        result = client.get(
+          "/auth/oauth2/callback/#{URI.encode_www_form(strat.id.as(String))}?code=test-code&state=#{kickoff_data[:state]}",
+          headers: HTTP::Headers{
+            "Host"   => "localhost",
+            "Cookie" => kickoff_data[:cookie],
+          },
+        )
+        result.status_code.should eq 303
+      ensure
+        strat.try &.destroy
+      end
+    end
+
     # ---- GET /auth/:provider/callback -------------------------------
 
     describe "GET /auth/:provider/callback" do

src/placeos-auth/controllers/provider_callbacks.cr

@@ -40,7 +40,7 @@ module PlaceOS::Auth
       raise Error::NotFound.new("authority not found") if current_authority.nil?
 
       provider_id = id
-      redirect_uri = callback_uri(provider)
+      redirect_uri = callback_uri(provider, provider_id)
 
       # Validate provider + strat exist before redirecting out. If the
       # caller invented a strat id we'd rather 404 here than after the
@@ -56,7 +56,7 @@ module PlaceOS::Auth
       state = Random::Secure.hex(16)
       session[SESSION_OAUTH_STATE] = "#{provider}|#{provider_id || ""}|#{state}"
 
-      redirect_to engine.authorize_uri(state: state), :see_other
+      redirect_to rewrite_b2clogin_redirect(engine.authorize_uri(state: state)), :see_other
     end
 
     # ---- GET/POST /auth/:provider/callback ----------------------------
@@ -78,7 +78,7 @@ module PlaceOS::Auth
         raise Error::Unauthorized.new("oauth state mismatch")
       end
 
-      redirect_uri = callback_uri(provider)
+      redirect_uri = callback_uri(provider, id)
       engine = ::MultiAuth.make(provider, redirect_uri, id)
 
       # `request.query_params` is `URI::Params` (Enumerable of
@@ -122,10 +122,31 @@ module PlaceOS::Auth
 
     # ---- private helpers -----------------------------------------------
 
-    private def callback_uri(provider : String) : String
+    # Builds the OAuth/SAML callback `redirect_uri`. The strategy id is
+    # carried as an `?id=<id>` query param — byte-for-byte what the legacy
+    # Ruby service sent (`generic_oauth#callback_url`) so the value stays
+    # identical to what external IdPs already have registered, and so the
+    # id round-trips back to `#callback`.
+    private def callback_uri(provider : String, id : String? = nil) : String
       scheme = request.headers["X-Forwarded-Proto"]? || (PlaceOS::Auth.production? ? "https" : "http")
       host = request.hostname || "localhost"
-      "#{scheme}://#{host}/auth/#{provider}/callback"
+      uri = "#{scheme}://#{host}/auth/#{provider}/callback"
+      uri += "?id=#{id}" if id && !id.empty?
+      uri
+    end
+
+    # Mirror the legacy `RewriteRedirectResponse` middleware. Azure AD B2C
+    # won't round-trip a query string on `redirect_uri`, so the strategy
+    # id is carried as a path segment instead. When the outbound authorize
+    # redirect targets a `*.b2clogin.com` host, rewrite the encoded
+    # `.../callback?id=<id>` to `.../callback/<id>` (the inbound path form
+    # is accepted by `callback_alias`). Only the authorize redirect is
+    # rewritten; the token-exchange `redirect_uri` stays in `?id=` form,
+    # exactly as the Ruby service behaved.
+    private def rewrite_b2clogin_redirect(authorize_uri : String) : String
+      host = URI.parse(authorize_uri).host
+      return authorize_uri unless host && host.ends_with?(".b2clogin.com")
+      authorize_uri.gsub("%3Fid%3D", "%2F").gsub("?id=", "/")
     end
 
     private def consume_stored_state : Tuple(String?, String?, String?)