From 576ea9edec7c3ea21dad3109049f03f2705edb4d Mon Sep 17 00:00:00 2001
From: nmemmert <67961292+nmemmert@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:41:41 -0500
Subject: [PATCH] Fix OAuth callback redirect issue - use proper redirect()
 instead of set_data()

---
 app.py | 52 +++++++++++++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/app.py b/app.py
index 83dc9fe..ab764a4 100644
--- a/app.py
+++ b/app.py
@@ -2,7 +2,13 @@ from flask import Flask, request, render_template, send_file, flash, redirect, u
 import os
 import tempfile
 import shutil
-import fitz
+try:
+    import fitz
+    PDF_SUPPORT = True
+except ImportError:
+    print("WARNING: PyMuPDF not available - PDF processing will not work")
+    PDF_SUPPORT = False
+    fitz = None
 from werkzeug.utils import secure_filename
 import zipfile
 import time
@@ -146,21 +152,24 @@ def auth_callback():
     print(f"DEBUG: Callback URL: {request.url}")
     print(f"DEBUG: Session keys: {list(session.keys())}")
     
-    # Add cache control headers to prevent browser caching
-    response = make_response()
-    response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
-    response.headers['Pragma'] = 'no-cache'
-    response.headers['Expires'] = '0'
-    
     # Check if already authenticated to prevent double callback
     if 'oauth_token' in session:
         print("DEBUG: Already authenticated, redirecting to index")
-        response.set_data(redirect(url_for('index')).get_data())
+        response = redirect(url_for('index'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
+        return response
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
     
     if 'oauth_state' not in session:
         print("DEBUG: No oauth_state in session, redirecting to login")
-        response.set_data(redirect(url_for('login')).get_data())
+        response = redirect(url_for('login'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
     
     # Parse the authorization response
@@ -172,24 +181,18 @@ def auth_callback():
     
     if 'error' in query_params:
         print(f"DEBUG: Error from Azure AD: {query_params['error'][0]}")
-        response.set_data(f"Authentication error: {query_params['error'][0]}")
-        response.status_code = 400
-        return response
+        return f"Authentication error: {query_params['error'][0]}", 400
     
     if 'code' not in query_params or 'state' not in query_params:
         print("DEBUG: Invalid authorization response - missing code or state")
-        response.set_data("Invalid authorization response")
-        response.status_code = 400
-        return response
+        return "Invalid authorization response", 400
     
     code = query_params['code'][0]
     state = query_params['state'][0]
     
     if state != session['oauth_state']:
         print(f"DEBUG: State mismatch: {state} != {session['oauth_state']}")
-        response.set_data("State mismatch")
-        response.status_code = 400
-        return response
+        return "State mismatch", 400
     
     # Exchange code for token using direct HTTP request with PKCE
     import requests
@@ -217,9 +220,7 @@ def auth_callback():
         
         if token_response.status_code != 200:
             print(f"DEBUG: Token exchange failed: {token_response.text}")
-            response.set_data(f"Token exchange failed: {token_response.text}")
-            response.status_code = 400
-            return response
+            return f"Token exchange failed: {token_response.text}", 400
         
         token = token_response.json()
         print(f"DEBUG: Token received successfully")
@@ -242,14 +243,15 @@ def auth_callback():
         session.pop('code_verifier', None)
         
         print("DEBUG: Authentication successful, redirecting to index")
-        response.set_data(redirect(url_for('index')).get_data())
+        response = redirect(url_for('index'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
         
     except requests.exceptions.RequestException as e:
         print(f"DEBUG: Request error during token exchange: {e}")
-        response.set_data(f"Authentication service error: {str(e)}")
-        response.status_code = 500
-        return response
+        return f"Authentication service error: {str(e)}", 500
 
 @app.route('/logout')
 def logout():