From 386bee1aa64c93da3f787595a5bd9bcda3528cfa Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Tue, 30 Sep 2025 20:33:11 +0000
Subject: [PATCH] fix: improve OIDC redirect URL validation and help text

addresses #327

Fixed issues when PUBLIC_URL is not set:
- Better error message explaining how to fix missing redirect URL
- Help text now shows actionable guidance instead of incomplete message
- Hide IdP redirect URL hint when no default is available
---
 .../src/components/Settings/OIDCPanel.tsx        | 16 +++++++++++-----
 internal/config/oidc.go                          |  2 +-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/frontend-modern/src/components/Settings/OIDCPanel.tsx b/frontend-modern/src/components/Settings/OIDCPanel.tsx
index c1810c218..2f152589b 100644
--- a/frontend-modern/src/components/Settings/OIDCPanel.tsx
+++ b/frontend-modern/src/components/Settings/OIDCPanel.tsx
@@ -324,7 +324,11 @@ export const OIDCPanel: Component<Props> = (props) => {
                 class={controlClass()}
                 disabled={isEnvLocked() || saving()}
               />
-              <p class={formHelpText}>If left blank, Pulse will use {config()?.defaultRedirect}.</p>
+              <p class={formHelpText}>
+                {config()?.defaultRedirect
+                  ? `If left blank, Pulse will use ${config()?.defaultRedirect}`
+                  : 'Set PUBLIC_URL environment variable or enter redirect URL manually'}
+              </p>
             </div>
           </div>
 
@@ -432,10 +436,12 @@ export const OIDCPanel: Component<Props> = (props) => {
           </div>
 
           <div class="flex flex-wrap items-center justify-between gap-3 pt-4">
-            <div class="text-xs text-gray-500 dark:text-gray-400">
-              Redirect URL registered with your IdP must match Pulse:{' '}
-              {config()?.defaultRedirect || ''}
-            </div>
+            <Show when={config()?.defaultRedirect}>
+              <div class="text-xs text-gray-500 dark:text-gray-400">
+                Redirect URL registered with your IdP must match Pulse:{' '}
+                {config()?.defaultRedirect}
+              </div>
+            </Show>
             <div class="flex gap-3">
               <button
                 type="button"
diff --git a/internal/config/oidc.go b/internal/config/oidc.go
index 34c085ce5..4f3f39e80 100644
--- a/internal/config/oidc.go
+++ b/internal/config/oidc.go
@@ -120,7 +120,7 @@ func (c *OIDCConfig) Validate() error {
 	}
 
 	if strings.TrimSpace(c.RedirectURL) == "" {
-		return fmt.Errorf("oidc redirect url is required when OIDC is enabled")
+		return fmt.Errorf("oidc redirect url is required when OIDC is enabled (set PUBLIC_URL environment variable or provide redirect URL manually)")
 	}
 	if _, err := url.ParseRequestURI(c.RedirectURL); err != nil {
 		return fmt.Errorf("invalid oidc redirect url: %w", err)