feat: implement HTTPS middleware and static OAuth URL configuration

musicround/helpers/auth_helpers.py

@@ -349,22 +349,62 @@ def update_oauth_tokens(user, tokens, auth_provider):
 def get_oauth_redirect_uri(endpoint, provider=None):
     """
     Generate OAuth redirect URI with proper scheme handling for reverse proxy environments
+    
+    This function chooses the redirect URI using the following priority:
+    1. Static URL from config (if STATIC_OAUTH_URLS is True)
+    2. Dynamic URL generated by url_for() with PREFERRED_URL_SCHEME
+    3. Force to HTTPS if USE_HTTPS=True regardless of incoming request
     """
-    # Use Flask's url_for which respects PREFERRED_URL_SCHEME
-    if provider:
-        redirect_uri = url_for(endpoint, provider=provider, _external=True)
-    else:
-        redirect_uri = url_for(endpoint, _external=True)
+    # Check if static OAuth URLs are enabled
+    use_static_urls = current_app.config.get('STATIC_OAUTH_URLS', False)
+    use_https = current_app.config.get('USE_HTTPS', False)
+    
+    # Define mapping from endpoint to config key for static URLs
+    static_url_mapping = {
+        'auth.callback': 'OAUTH_SPOTIFY_AUTH_URL',
+        'users.spotify_link_callback': 'OAUTH_SPOTIFY_LINK_URL',
+        'users.google_callback': 'OAUTH_GOOGLE_URL',
+        'users.authentik_callback': 'OAUTH_AUTHENTIK_URL',
+        'users.dropbox_callback': 'OAUTH_DROPBOX_URL'
+    }
+    
+    # First try to use a static URL if enabled and available
+    redirect_uri = None
+    if use_static_urls and endpoint in static_url_mapping:
+        config_key = static_url_mapping[endpoint]
+        redirect_uri = current_app.config.get(config_key)
+        if redirect_uri:
+            current_app.logger.debug(f"Using static OAuth URL for {endpoint}: {redirect_uri}")
+        else:
+            current_app.logger.warning(
+                f"Static OAuth URLs enabled but no URL defined for {endpoint} "
+                f"(expected config key: {config_key})"
+            )
+    
+    # If no static URL, use Flask's url_for which respects PREFERRED_URL_SCHEME
+    if not redirect_uri:
+        if provider:
+            redirect_uri = url_for(endpoint, provider=provider, _external=True)
+        else:
+            redirect_uri = url_for(endpoint, _external=True)
+        
+        # Force HTTPS when USE_HTTPS=True regardless of the generated URL scheme
+        if use_https and redirect_uri.startswith('http:'):
+            redirect_uri = 'https:' + redirect_uri[5:]
+            current_app.logger.info(f"Forcing HTTPS for OAuth redirect URI: {redirect_uri}")
     
     # Log details about the generated URL for debugging
-    use_https = current_app.config.get('USE_HTTPS', False)
     preferred_scheme = current_app.config.get('PREFERRED_URL_SCHEME', 'http')
+    static_enabled = "Yes" if use_static_urls else "No"
+    static_url_used = "Yes" if use_static_urls and redirect_uri and endpoint in static_url_mapping and current_app.config.get(static_url_mapping[endpoint]) else "No"
     
     current_app.logger.debug(
         f"OAuth Redirect URI: {redirect_uri} | "
         f"Endpoint: {endpoint} | "
         f"USE_HTTPS: {use_https} | "
         f"PREFERRED_URL_SCHEME: {preferred_scheme} | "
+        f"Static URLs enabled: {static_enabled} | "
+        f"Used static URL: {static_url_used} | "
         f"Request scheme: {request.scheme if request else 'N/A'} | "
         f"X-Forwarded-Proto: {request.headers.get('X-Forwarded-Proto', 'N/A') if request else 'N/A'}"
     )