fix(dropbox): fix Invalid redirect_uri error by adding PUBLIC_BASE_URL config and URL-encoding

- Add PUBLIC_BASE_URL optional config to override auto-detected OAuth redirect URIs
  when behind a reverse proxy that doesn't forward X-Forwarded-Proto headers
- Add _build_dropbox_redirect_uri() helper in app/api/dropbox.py
- URL-encode redirect_uri in server-side Dropbox authorization URL
- Add _get_dropbox_callback_url() helper in app/views/dropbox.py
- Pass callback_url to both setup and callback templates
- Update templates to use server-provided callback_url instead of window.location.origin
- Update settings_service.py to register new setting
- Update .env.demo, ConfigurationGuide.md, and DropboxSetup.md documentation
- Add tests for new helper functions and global-authorize-url endpoint

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/api/dropbox.py

@@ -5,6 +5,7 @@ Dropbox API endpoints
 import logging
 import os
 from typing import Annotated, Optional
+from urllib.parse import quote
 
 import httpx
 from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
@@ -23,6 +24,18 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _build_dropbox_redirect_uri(request: Request) -> str:
+    """Build the Dropbox OAuth callback redirect URI.
+
+    Uses ``PUBLIC_BASE_URL`` when configured (recommended for deployments behind
+    a reverse proxy that doesn't forward ``X-Forwarded-Proto``).  Falls back to
+    deriving the URI from the incoming request's scheme and host headers.
+    """
+    if settings.public_base_url:
+        return settings.public_base_url.rstrip("/") + "/dropbox-callback"
+    return f"{request.url.scheme}://{request.url.netloc}/dropbox-callback"
+
+
 @router.get("/dropbox/global-authorize-url")
 @require_login
 async def dropbox_global_authorize_url(request: Request):
@@ -43,13 +56,13 @@ async def dropbox_global_authorize_url(request: Request):
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
             detail="Global Dropbox credentials are not configured",
         )
-    redirect_uri = str(request.base_url).rstrip("/") + "/dropbox-callback"
+    redirect_uri = _build_dropbox_redirect_uri(request)
     authorize_url = (
         "https://www.dropbox.com/oauth2/authorize"
         f"?client_id={settings.dropbox_app_key}"
         "&response_type=code"
         "&token_access_type=offline"
-        f"&redirect_uri={redirect_uri}"
+        f"&redirect_uri={quote(redirect_uri, safe='')}"
     )
     return {"authorize_url": authorize_url}
 

app/config.py

@@ -193,6 +193,16 @@ class Settings(BaseSettings):
     google_docai_processor_id: Optional[str] = None
     google_docai_location: str = "us"  # Processor location, e.g. "us" or "eu"
     external_hostname: str = "localhost"  # Default to localhost
+    public_base_url: Optional[str] = Field(
+        default=None,
+        description=(
+            "The full public base URL of the application, including scheme "
+            "(e.g., 'https://docuelevate.example.com'). "
+            "When set, this overrides the auto-detected URL for OAuth redirect URIs. "
+            "This is required when the application is behind a reverse proxy that does "
+            "not forward X-Forwarded-Proto headers correctly."
+        ),
+    )
 
     # ---------------------------------------------------------------------------
     # Document Translation Settings

app/utils/settings_service.py

@@ -99,6 +99,18 @@ SETTING_METADATA = {
         "required": True,  # Required for OAuth redirects and external URLs
         "restart_required": True,
     },
+    "public_base_url": {
+        "category": "Core",
+        "description": (
+            "Full public base URL including scheme (e.g., https://docuelevate.example.com). "
+            "When set, overrides auto-detected URLs for OAuth redirect URIs. "
+            "Required when behind a reverse proxy that does not forward X-Forwarded-Proto."
+        ),
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
     "debug": {
         "category": "Core",
         "description": "Enable debug mode for verbose logging",

app/views/dropbox.py

@@ -14,6 +14,19 @@ from app.views.base import APIRouter, Depends, get_db, require_login, settings,
 router = APIRouter()
 
 
+def _get_dropbox_callback_url(request: Request) -> str:
+    """Return the Dropbox OAuth callback URL.
+
+    Uses ``PUBLIC_BASE_URL`` when configured so that the redirect URI displayed
+    to the user (and registered in the Dropbox developer console) matches the
+    one used in the OAuth authorization request.  Falls back to deriving the URL
+    from the incoming request when ``PUBLIC_BASE_URL`` is not set.
+    """
+    if settings.public_base_url:
+        return settings.public_base_url.rstrip("/") + "/dropbox-callback"
+    return f"{request.url.scheme}://{request.url.netloc}/dropbox-callback"
+
+
 @router.get("/dropbox-setup")
 @require_login
 async def dropbox_setup_page(
@@ -30,6 +43,8 @@ async def dropbox_setup_page(
     path from the integration's existing config is pre-populated; global
     admin credentials are never exposed in this mode.
     """
+    callback_url = _get_dropbox_callback_url(request)
+
     if integration_id is not None:
         owner_id = get_current_owner_id(request)
         integration = (
@@ -67,6 +82,7 @@ async def dropbox_setup_page(
                     "app_secret_value": "",
                     "refresh_token_value": "",
                     "global_creds_available": global_creds_available,
+                    "callback_url": callback_url,
                 },
             )
 
@@ -86,6 +102,7 @@ async def dropbox_setup_page(
             "integration_id": integration_id,
             "integration_name": None,
             "integration_type": None,
+            "callback_url": callback_url,
         },
     )
 
@@ -116,5 +133,6 @@ async def dropbox_callback(request: Request, code: str = None, error: str = None
             "app_key_value": "",  # The callback will prioritize sessionStorage values
             "app_secret_value": "",  # The callback will prioritize sessionStorage values
             "folder_path": "",  # The callback will prioritize sessionStorage values
+            "callback_url": _get_dropbox_callback_url(request),
         },
     )