feat(oauth2): add support for relative routing of URLs

src/Network/OAuth/OAuth2/Compat.hs

@@ -44,6 +44,7 @@ data OAuth2 = OAuth2
     , oauth2AuthorizeEndpoint :: URIRef Absolute
     , oauth2TokenEndpoint :: URIRef Absolute
     , oauth2RedirectUri :: Maybe (URIRef Absolute)
+    , oauth2AppRoot :: Maybe Text
     }
 
 #if MIN_VERSION_hoauth2(2,7,0)

src/Yesod/Auth/OAuth2/Auth0.hs

@@ -54,4 +54,5 @@ oauth2Auth0HostScopes host scopes clientId clientSecret =
       host `withPath` "/authorize" `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = host `withPath` "/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/AzureAD.hs

@@ -53,4 +53,5 @@ oauth2AzureADScoped scopes clientId clientSecret =
                     ]
     , oauth2TokenEndpoint = "https://login.windows.net/common/oauth2/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/AzureADv2.hs

@@ -72,6 +72,7 @@ oauth2AzureADv2Scoped scopes tenantId clientId clientSecret =
       tenantUrl "/authorize" `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = tenantUrl "/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }
 
   tenantUrl path =

src/Yesod/Auth/OAuth2/BattleNet.hs

@@ -52,6 +52,7 @@ oauth2BattleNet widget region clientId clientSecret =
     , oauth2AuthorizeEndpoint = fromRelative "https" host "/oauth/authorize"
     , oauth2TokenEndpoint = fromRelative "https" host "/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }
 
 

src/Yesod/Auth/OAuth2/Bitbucket.hs

@@ -58,4 +58,5 @@ oauth2BitbucketScoped scopes clientId clientSecret =
         `withQuery` [scopeParam "," scopes]
     , oauth2TokenEndpoint = "https://bitbucket.com/site/oauth2/access_token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/ClassLink.hs

@@ -46,4 +46,5 @@ oauth2ClassLinkScoped scopes clientId clientSecret =
         `withQuery` [scopeParam "," scopes]
     , oauth2TokenEndpoint = "https://launchpad.classlink.com/oauth2/v2/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Dispatch.hs

@@ -100,7 +100,11 @@ withCallbackAndState
   -> Text
   -> m OAuth2
 withCallbackAndState name oauth2 csrf = do
-  uri <- ($ PluginR name ["callback"]) <$> getParentUrlRender
+  pluginURI <- ($ PluginR name ["callback"]) <$> getParentUrlRender
+  let uri =
+        case oauth2AppRoot oauth2 of
+          Just root -> root <> pluginURI
+          Nothing -> pluginURI
   callback <- maybe (throwError $ InvalidCallbackUri uri) pure $ fromText uri
   pure oauth2
     { oauth2RedirectUri = Just callback

src/Yesod/Auth/OAuth2/EveOnline.hs

@@ -78,4 +78,5 @@ oauth2EveScoped scopes widgetType clientId clientSecret =
         `withQuery` [("response_type", "code"), scopeParam " " scopes]
     , oauth2TokenEndpoint = "https://login.eveonline.com/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/GitHub.hs

@@ -52,4 +52,5 @@ oauth2GitHubScoped scopes clientId clientSecret =
         `withQuery` [scopeParam "," scopes]
     , oauth2TokenEndpoint = "https://github.com/login/oauth/access_token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/GitLab.hs

@@ -56,4 +56,5 @@ oauth2GitLabHostScopes host scopes clientId clientSecret =
       host `withPath` "/oauth/authorize" `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = host `withPath` "/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Google.hs

@@ -83,4 +83,5 @@ oauth2GoogleScopedWidget widget scopes clientId clientSecret =
         `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = "https://www.googleapis.com/oauth2/v3/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Nylas.hs

@@ -63,4 +63,5 @@ oauth2Nylas clientId clientSecret =
                     ]
     , oauth2TokenEndpoint = "https://api.nylas.com/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Okta.hs

@@ -46,6 +46,8 @@ oauth2Okta ::
   Text ->
   -- | The authorization server
   ByteString ->
+  -- | Application Root for redirect links
+  Maybe (URIRef Absolute) ->
   AuthPlugin m
 oauth2Okta = oauth2OktaWithScopes defaultOktaScopes
 
@@ -62,8 +64,10 @@ oauth2OktaWithScopes ::
   Text ->
   -- | The authorization server
   ByteString ->
+  -- | Application Root for building callbacks
+  Maybe (URIRef Absolute) ->
   AuthPlugin m
-oauth2OktaWithScopes scopes host clientId clientSecret authorizationServer =
+oauth2OktaWithScopes scopes host clientId clientSecret authorizationServer appRoot =
   authOAuth2 pluginName oauth2 $ \manager token -> do
     (User uid, userResponse) <-
       authGetProfile
@@ -87,7 +91,8 @@ oauth2OktaWithScopes scopes host clientId clientSecret authorizationServer =
               `withPath` (mkEndpointSegment authorizationServer "authorize")
               `withQuery` [scopeParam " " scopes],
           oauth2TokenEndpoint = host `withPath` (mkEndpointSegment authorizationServer "token"),
-          oauth2RedirectUri = Nothing
+          oauth2RedirectUri = Nothing,
+          oauth2AppRoot = appRoot
         }
 
 -- | Helper function for creating an endpoint path segment for the given authorization server

src/Yesod/Auth/OAuth2/Salesforce.hs

@@ -73,4 +73,5 @@ salesforceHelper name profileUri authorizeUri tokenUri scopes clientId clientSec
     , oauth2AuthorizeEndpoint = authorizeUri `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = tokenUri
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Slack.hs

@@ -72,4 +72,5 @@ oauth2SlackScoped scopes clientId clientSecret =
         `withQuery` [scopeParam "," $ map scopeText scopes]
     , oauth2TokenEndpoint = "https://slack.com/api/oauth.access"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Spotify.hs

@@ -40,4 +40,5 @@ oauth2Spotify scopes clientId clientSecret =
         `withQuery` [scopeParam " " scopes]
     , oauth2TokenEndpoint = "https://accounts.spotify.com/api/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Twitch.hs

@@ -56,4 +56,5 @@ oauth2TwitchScoped scopes clientId clientSecret =
                     , ("client_secret", T.encodeUtf8 clientSecret)
                     ]
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/Upcase.hs

@@ -45,4 +45,5 @@ oauth2Upcase clientId clientSecret =
     , oauth2AuthorizeEndpoint = "http://upcase.com/oauth/authorize"
     , oauth2TokenEndpoint = "http://upcase.com/oauth/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }

src/Yesod/Auth/OAuth2/WordPressDotCom.hs

@@ -43,4 +43,5 @@ oauth2WordPressDotCom clientId clientSecret =
         `withQuery` [scopeParam "," ["auth"]]
     , oauth2TokenEndpoint = "https://public-api.wordpress.com/oauth2/token"
     , oauth2RedirectUri = Nothing
+    , oauth2AppRoot = Nothing
     }