Fix redirect bugs in SaaS (#7721)

# Description of Changes
Fixes various bugs that affected SaaS (and some self-hosted):
- Refreshing on Editor caused the user to be redirected to Processor 
- User was unable to access Processor in SaaS
- Deep link hijacking fixes
- Fix double prefix `/app/app` issue
- Fix going from tool -> editor -> processor -> editor putting you back
into tool

---------

Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>

Author: jbrunton96

frontend/editor/src/core/components/shared/quickNav/QuickNavRailHost.tsx

@@ -20,7 +20,7 @@ const SIZE = "1.125rem";
 export function QuickNavRailHost() {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const { pathname, search } = useLocation();
+  const { pathname } = useLocation();
   const host = useQuickNavHost();
 
   const appMounted = Boolean(host?.appMounted);
@@ -74,7 +74,7 @@ export function QuickNavRailHost() {
           returnHome();
           return;
         }
-        saveEditorReturnPath(pathname + search);
+        saveEditorReturnPath();
         go(PORTAL_BASENAME);
       },
     },

frontend/editor/src/core/contexts/ToolWorkflowContext.tsx

@@ -29,6 +29,8 @@ import {
   isBaseWorkbench,
 } from "@app/types/workbench";
 import { useNavigationUrlSync } from "@app/hooks/useUrlSync";
+import { stripBasePath } from "@app/constants/app";
+import { EDITOR_BASENAME } from "@app/routes/editorBasename";
 import { filterToolRegistryByQuery } from "@app/utils/toolSearch";
 import { useToolHistory } from "@app/hooks/tools/useUserToolActivity";
 import {
@@ -373,15 +375,28 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
   // This runs once to navigate to the user's preferred tab (read/automate)
   // instead of always starting on the tools tab.
   const hasAppliedStartupView = React.useRef(false);
+  // Set when the startup view picks the tool, so the URL sync knows this
+  // selection came from a preference and must not be written to the address.
+  const startupSelectedToolRef = React.useRef<ToolId | null>(null);
   useEffect(() => {
     if (hasAppliedStartupView.current) return;
+    // The URL wins: the startup view decides what you see when you arrive at the
+    // editor's home, never what a deep link to a tool shows. Without this, a
+    // "Reader" preference rewrote every /<tool> link to /read.
+    const path = stripBasePath(window.location.pathname);
+    if (path !== "/" && path !== EDITOR_BASENAME) {
+      hasAppliedStartupView.current = true;
+      return;
+    }
     const startupView = preferences.defaultStartupView;
     if (startupView === "read") {
       hasAppliedStartupView.current = true;
+      startupSelectedToolRef.current = "read";
       setReaderMode(true);
       actions.setSelectedTool("read");
     } else if (startupView === "automate") {
       hasAppliedStartupView.current = true;
+      startupSelectedToolRef.current = "automate";
       actions.setSelectedTool("automate");
       setLeftPanelView("toolContent");
     }
@@ -573,6 +588,7 @@ export function ToolWorkflowProvider({ children }: ToolWorkflowProviderProps) {
     handleBackToTools,
     allTools,
     true,
+    startupSelectedToolRef,
   );
 
   // Ref-backed wrappers so callback identities stay stable across renders.

frontend/editor/src/core/hooks/useUrlSync.test.tsx

@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { useRef } from "react";
+import type { ToolId } from "@app/types/toolId";
+
+const h = vi.hoisted(() => ({
+  updateToolRoute: vi.fn(),
+  clearToolRoute: vi.fn(),
+}));
+
+vi.mock("@app/utils/urlRouting", () => ({
+  parseToolRoute: () => ({ workbench: "fileEditor", toolId: null }),
+  updateToolRoute: h.updateToolRoute,
+  clearToolRoute: h.clearToolRoute,
+}));
+vi.mock("@app/utils/scarfTracking", () => ({ firePixel: vi.fn() }));
+vi.mock("@app/contexts/AppConfigContext", () => ({
+  useAppConfig: () => ({ config: { premiumEnabled: true } }),
+}));
+
+import { useNavigationUrlSync } from "@app/hooks/useUrlSync";
+
+const registry = {
+  read: { name: "Read", workbench: "viewer" },
+  compress: { name: "Compress", workbench: "fileEditor" },
+} as never;
+
+/** Drives the hook the way ToolWorkflowContext does, with a startup marker. */
+function useHarness(selectedTool: ToolId | null, startupTool: ToolId | null) {
+  const ref = useRef<ToolId | null>(startupTool);
+  useNavigationUrlSync(selectedTool, vi.fn(), vi.fn(), registry, true, ref);
+  return ref;
+}
+
+describe("useNavigationUrlSync — startup-view selections", () => {
+  beforeEach(() => h.updateToolRoute.mockClear());
+
+  // The default-startup-view preference selects a tool to change the *view*.
+  // Writing it to the address turned every visit to /editor into /read.
+  it("never writes the URL for the startup-applied tool", () => {
+    const { rerender } = renderHook(
+      ({ tool }: { tool: ToolId | null }) => useHarness(tool, "read" as ToolId),
+      { initialProps: { tool: null as ToolId | null } },
+    );
+    rerender({ tool: "read" as ToolId });
+    expect(h.updateToolRoute).not.toHaveBeenCalled();
+  });
+
+  // The effect re-runs whenever the registry identity changes, so a marker that
+  // was consumed on first sight let the second run write /read anyway.
+  it("survives a re-run for the same tool", () => {
+    const { rerender } = renderHook(
+      ({ tool }: { tool: ToolId | null }) => useHarness(tool, "read" as ToolId),
+      { initialProps: { tool: null as ToolId | null } },
+    );
+    rerender({ tool: "read" as ToolId });
+    rerender({ tool: "read" as ToolId });
+    rerender({ tool: "read" as ToolId });
+    expect(h.updateToolRoute).not.toHaveBeenCalled();
+  });
+
+  it("still writes the URL when the user picks a different tool", () => {
+    const { rerender } = renderHook(
+      ({ tool }: { tool: ToolId | null }) => useHarness(tool, "read" as ToolId),
+      { initialProps: { tool: null as ToolId | null } },
+    );
+    rerender({ tool: "read" as ToolId });
+    rerender({ tool: "compress" as ToolId });
+    expect(h.updateToolRoute).toHaveBeenCalledWith("compress", registry, false);
+  });
+
+  it("writes the URL for a tool chosen without a startup marker", () => {
+    const { rerender } = renderHook(
+      ({ tool }: { tool: ToolId | null }) => useHarness(tool, null),
+      { initialProps: { tool: null as ToolId | null } },
+    );
+    rerender({ tool: "read" as ToolId });
+    expect(h.updateToolRoute).toHaveBeenCalledWith("read", registry, false);
+  });
+});

frontend/editor/src/core/hooks/useUrlSync.ts

@@ -2,7 +2,7 @@
  * URL synchronization hooks for tool routing with registry support
  */
 
-import { useEffect, useCallback, useRef } from "react";
+import { useEffect, useCallback, useRef, type MutableRefObject } from "react";
 import { ToolId } from "@app/types/toolId";
 import {
   parseToolRoute,
@@ -24,6 +24,11 @@ export function useNavigationUrlSync(
   clearToolSelection: () => void,
   registry: ToolRegistry,
   enableSync: boolean = true,
+  /**
+   * Tool the default-startup-view preference selected, if any. That selection
+   * sets the view, not the address, so it must not be written to the URL.
+   */
+  startupSelectedToolRef?: MutableRefObject<ToolId | null>,
 ) {
   const { config } = useAppConfig();
   const premiumEnabled = config?.premiumEnabled;
@@ -77,8 +82,16 @@ export function useNavigationUrlSync(
   useEffect(() => {
     if (!enableSync) return;
 
+    const startupTool = startupSelectedToolRef?.current ?? null;
+
     if (selectedTool) {
-      updateToolRoute(selectedTool, registry, false); // Use pushState for user navigation
+      // A startup-view selection is a view preference, not a navigation: writing
+      // it here rewrote /editor to /read on every load. The effect re-runs
+      // whenever the registry identity changes, so the marker has to survive
+      // until the selection actually moves off it (cleared below).
+      if (startupTool !== selectedTool) {
+        updateToolRoute(selectedTool, registry, false); // Use pushState for user navigation
+      }
     } else if (prevSelectedTool.current !== null) {
       // Only clear URL if we had a tool before (user navigated away)
       // Don't clear on initial load when both current and previous are null
@@ -88,8 +101,19 @@ export function useNavigationUrlSync(
       }
     }
 
+    // Spent once the user leaves the startup-applied tool, so re-picking it
+    // later is a real navigation and does update the URL.
+    if (
+      startupSelectedToolRef &&
+      startupTool !== null &&
+      prevSelectedTool.current === startupTool &&
+      selectedTool !== startupTool
+    ) {
+      startupSelectedToolRef.current = null;
+    }
+
     prevSelectedTool.current = selectedTool;
-  }, [selectedTool, registry, enableSync]);
+  }, [selectedTool, registry, enableSync, startupSelectedToolRef]);
 
   // Handle browser back/forward navigation
   useEffect(() => {

frontend/editor/src/core/services/httpErrorHandler.basePath.test.ts

@@ -0,0 +1,76 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@app/components/toast", () => ({ alert: vi.fn() }));
+vi.mock("@app/services/specialErrorToasts", () => ({
+  showSpecialErrorToast: vi.fn(() => false),
+}));
+vi.mock("@app/services/saasErrorInterceptor", () => ({
+  handleSaaSError: vi.fn(() => false),
+}));
+vi.mock("@app/services/errorUtils", () => ({
+  broadcastErroredFiles: vi.fn(),
+  extractErrorFileIds: vi.fn(() => []),
+  normalizeAxiosErrorData: vi.fn(async (d: unknown) => d),
+}));
+
+const hrefs: string[] = [];
+
+/** Serve the app from `base`, sitting on `pathname`, then load the handler fresh. */
+async function loadAt(base: string, pathname: string) {
+  document.head.innerHTML = `<base href="${base}" />`;
+  Object.defineProperty(window, "location", {
+    configurable: true,
+    value: {
+      pathname,
+      search: "",
+      origin: "http://localhost:3000",
+      get href() {
+        // Absolute: jsdom resolves <base href> against this.
+        return "http://localhost:3000" + pathname;
+      },
+      set href(v: string) {
+        hrefs.push(v);
+      },
+    },
+  });
+  vi.resetModules();
+  return (await import("@app/services/httpErrorHandler")).handleHttpError;
+}
+
+const unauthorized = {
+  isAxiosError: true,
+  message: "unauthorized",
+  config: {},
+  response: { status: 401, data: {} },
+};
+
+beforeEach(() => {
+  hrefs.length = 0;
+  sessionStorage.clear();
+  localStorage.clear();
+});
+afterEach(() => vi.resetModules());
+
+describe("401 return path is router-relative", () => {
+  // Login replays this through navigate(), which re-applies the router
+  // basename. Carrying /app here produced /app/app/compress.
+  it("strips the base path on a subpath deploy", async () => {
+    const handle = await loadAt("/app/", "/app/compress");
+    await handle(unauthorized);
+
+    expect(sessionStorage.getItem("stirling_post_login_path")).toBe(
+      "/compress",
+    );
+    expect(hrefs[0]).toBe("/app/login?from=%2Fcompress");
+  });
+
+  it("is unchanged at the origin root", async () => {
+    const handle = await loadAt("/", "/compress");
+    await handle(unauthorized);
+
+    expect(sessionStorage.getItem("stirling_post_login_path")).toBe(
+      "/compress",
+    );
+    expect(hrefs[0]).toBe("/login?from=%2Fcompress");
+  });
+});

frontend/editor/src/core/services/httpErrorHandler.ts

@@ -12,7 +12,8 @@ import {
   clampText,
   extractAxiosErrorMessage,
 } from "@app/services/httpErrorUtils";
-import { withBasePath } from "@app/constants/app";
+import { stripBasePath, withBasePath } from "@app/constants/app";
+import { isSafePostLoginRedirect } from "@app/services/postLoginRedirect";
 
 // Module-scoped state to reduce global variable usage
 const recentSpecialByEndpoint: Record<string, number> = {};
@@ -21,26 +22,9 @@ const SPECIAL_SUPPRESS_MS = 1500; // brief window to suppress generic duplicate
 // Mirrors the key in proprietary/auth/springAuthClient.ts; AuthCallback consumes it.
 const POST_LOGIN_REDIRECT_STORAGE_KEY = "stirling_post_login_path";
 
-function isSafePostLoginPath(path: string): boolean {
-  if (
-    !path.startsWith("/") ||
-    path.startsWith("//") ||
-    path.startsWith("/\\")
-  ) {
-    return false;
-  }
-  const lowered = path.toLowerCase();
-  return (
-    !lowered.startsWith("/login") &&
-    !lowered.startsWith("/auth/") &&
-    !lowered.startsWith("/oauth2") &&
-    !lowered.startsWith("/saml2")
-  );
-}
-
 function stashPostLoginRedirect(path: string): void {
   try {
-    if (typeof window === "undefined" || !isSafePostLoginPath(path)) return;
+    if (typeof window === "undefined" || !isSafePostLoginRedirect(path)) return;
     window.sessionStorage.setItem(POST_LOGIN_REDIRECT_STORAGE_KEY, path);
   } catch {
     // sessionStorage unavailable (private mode) — fail open
@@ -128,7 +112,11 @@ export async function handleHttpError(error: unknown): Promise<boolean> {
       console.debug("[httpErrorHandler] 401 detected, redirecting to login");
       // Spring 302-strips the ?from= query from /login, so stash the return
       // path in sessionStorage (AuthCallback reads it after SSO round-trip).
-      const currentLocation = window.location.pathname + window.location.search;
+      // Router-relative, not browser-relative: every consumer replays this
+      // through navigate(), which re-applies the basename. Keeping the base
+      // path here yields /app/app/<tool> on a subpath deploy.
+      const currentLocation =
+        stripBasePath(window.location.pathname) + window.location.search;
       stashPostLoginRedirect(currentLocation);
       let hadStoredJwt = false;
       try {

frontend/editor/src/core/services/postLoginRedirect.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { isSafePostLoginRedirect } from "@app/services/postLoginRedirect";
+
+// Core default. Rejects off-origin forms and the auth routes every build has
+// (/login, /auth/…); Spring SSO routes are the proprietary override's concern.
+describe("isSafePostLoginRedirect (core base)", () => {
+  it("accepts same-origin router paths", () => {
+    expect(isSafePostLoginRedirect("/editor")).toBe(true);
+    expect(isSafePostLoginRedirect("/compress")).toBe(true);
+    expect(isSafePostLoginRedirect("/editor?foo=bar")).toBe(true);
+    expect(isSafePostLoginRedirect("/oauth/consent?x=1")).toBe(true);
+    expect(isSafePostLoginRedirect("/")).toBe(true);
+  });
+
+  it("rejects empty and non-string values", () => {
+    expect(isSafePostLoginRedirect(null)).toBe(false);
+    expect(isSafePostLoginRedirect(undefined)).toBe(false);
+    expect(isSafePostLoginRedirect("")).toBe(false);
+    expect(isSafePostLoginRedirect(42 as unknown)).toBe(false);
+  });
+
+  it("rejects off-origin and protocol-relative forms", () => {
+    expect(isSafePostLoginRedirect("//evil.example.com")).toBe(false);
+    expect(isSafePostLoginRedirect("/\\evil.example.com")).toBe(false);
+    expect(isSafePostLoginRedirect("https://evil.example.com")).toBe(false);
+    expect(isSafePostLoginRedirect("editor")).toBe(false);
+  });
+
+  it("rejects the universal auth routes so returning back can never loop", () => {
+    expect(isSafePostLoginRedirect("/login")).toBe(false);
+    expect(isSafePostLoginRedirect("/login?next=%2Feditor")).toBe(false);
+    expect(isSafePostLoginRedirect("/auth/callback")).toBe(false);
+  });
+
+  it("leaves the Spring SSO routes to the proprietary override", () => {
+    expect(isSafePostLoginRedirect("/oauth2/authorize")).toBe(true);
+    expect(isSafePostLoginRedirect("/saml2/login")).toBe(true);
+  });
+});

frontend/editor/src/core/services/postLoginRedirect.ts

@@ -0,0 +1,15 @@
+/**
+ * Is `path` safe to send a user back to after they log in?
+ */
+export function isSafePostLoginRedirect(path: unknown): path is string {
+  if (typeof path !== "string" || path.length === 0) return false;
+  if (
+    !path.startsWith("/") ||
+    path.startsWith("//") ||
+    path.startsWith("/\\")
+  ) {
+    return false;
+  }
+  const lowered = path.toLowerCase();
+  return !lowered.startsWith("/login") && !lowered.startsWith("/auth/");
+}