From 41d5835414082fc6e21f2d668ffd07a34afcf6ec Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Tue, 20 Aug 2024 15:22:03 -0500
Subject: Pass GET parameters for correct redirection.

---
 gn_auth/auth/authorisation/users/views.py    | 25 +++++++++++++++++++++----
 gn_auth/templates/oauth2/authorise-user.html |  5 ++++-
 gn_auth/templates/users/forgot-password.html |  5 ++++-
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/gn_auth/auth/authorisation/users/views.py b/gn_auth/auth/authorisation/users/views.py
index 3083724..3323f4d 100644
--- a/gn_auth/auth/authorisation/users/views.py
+++ b/gn_auth/auth/authorisation/users/views.py
@@ -1,4 +1,5 @@
 """User authorisation endpoints."""
+import uuid
 import sqlite3
 import secrets
 import traceback
@@ -368,7 +369,13 @@ def send_verification_code():
     return resp
 
 
-def send_forgot_password_email(conn, user: User):
+def send_forgot_password_email(
+        conn,
+        user: User,
+        client_id: uuid.UUID,
+        redirect_uri: str,
+        response_type: str
+):
     """Send the 'forgot-password' email."""
     subject="GeneNetwork: Change Your Password"
     token = secrets.token_urlsafe(64)
@@ -380,7 +387,10 @@ def send_forgot_password_email(conn, user: User):
                                forgot_password_uri=urljoin(
                                    request.url,
                                    url_for("oauth2.users.change_password",
-                                           forgot_password_token=token)),
+                                           forgot_password_token=token,
+                                           client_id=client_id,
+                                           redirect_uri=redirect_uri,
+                                           response_type=response_type)),
                                expiration_minutes=expiration_minutes)
 
     with db.cursor(conn) as cursor:
@@ -413,7 +423,10 @@ def send_forgot_password_email(conn, user: User):
 def forgot_password():
     """Enable user to request password change."""
     if request.method == "GET":
-        return render_template("users/forgot-password.html")
+        return render_template("users/forgot-password.html",
+                               client_id=request.args["client_id"],
+                               redirect_uri=request.args["redirect_uri"],
+                               response_type=request.args["response_type"])
 
     form = request.form
     email = form.get("email", "").strip()
@@ -429,7 +442,11 @@ def forgot_password():
                   "alert-danger")
             return redirect(url_for("oauth2.users.forgot_password"))
 
-        send_forgot_password_email(conn, user)
+        send_forgot_password_email(conn,
+                                   user,
+                                   request.args["client_id"],
+                                   request.args["redirect_uri"],
+                                   request.args["response_type"])
         return render_template("users/forgot-password-token-send-success.html")
 
 
diff --git a/gn_auth/templates/oauth2/authorise-user.html b/gn_auth/templates/oauth2/authorise-user.html
index 07edb73..2ef22af 100644
--- a/gn_auth/templates/oauth2/authorise-user.html
+++ b/gn_auth/templates/oauth2/authorise-user.html
@@ -33,7 +33,10 @@
   <div class="form-group">
     <input type="submit" value="authorise" class="btn btn-primary" />
     {%if display_forgot_password%}
-    <a href="{{url_for('oauth2.users.forgot_password')}}"
+    <a href="{{url_for('oauth2.users.forgot_password',
+             client_id=client.client_id,
+             redirect_uri=redirect_uri,
+             response_type=response_type)}}"
        title="Click here to change your password."
        class="form-text text-danger">Forgot Password</a>
     {%endif%}
diff --git a/gn_auth/templates/users/forgot-password.html b/gn_auth/templates/users/forgot-password.html
index 94fcc68..0455c69 100644
--- a/gn_auth/templates/users/forgot-password.html
+++ b/gn_auth/templates/users/forgot-password.html
@@ -12,7 +12,10 @@
 
   <div class="row">
     <form method="POST"
-          action="{{url_for('oauth2.users.forgot_password')}}">
+          action="{{url_for('oauth2.users.forgot_password',
+                  client_id=client_id,
+                  redirect_uri=redirect_uri,
+                  response_type=response_type)}}">
       <div class="form-group">
         <span>
           Provide you email below, and we will send you a link you can use to
-- 
cgit v1.2.3