Fix OAuth callback redirect issue - use proper redirect() instead of set_data()

app.py

@@ -2,7 +2,13 @@ from flask import Flask, request, render_template, send_file, flash, redirect, u
 import os
 import tempfile
 import shutil
+try:
     import fitz
+    PDF_SUPPORT = True
+except ImportError:
+    print("WARNING: PyMuPDF not available - PDF processing will not work")
+    PDF_SUPPORT = False
+    fitz = None
 from werkzeug.utils import secure_filename
 import zipfile
 import time
@@ -146,21 +152,24 @@ def auth_callback():
     print(f"DEBUG: Callback URL: {request.url}")
     print(f"DEBUG: Session keys: {list(session.keys())}")
     
-    # Add cache control headers to prevent browser caching
-    response = make_response()
-    response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
-    response.headers['Pragma'] = 'no-cache'
-    response.headers['Expires'] = '0'
-    
     # Check if already authenticated to prevent double callback
     if 'oauth_token' in session:
         print("DEBUG: Already authenticated, redirecting to index")
-        response.set_data(redirect(url_for('index')).get_data())
+        response = redirect(url_for('index'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
+        return response
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
     
     if 'oauth_state' not in session:
         print("DEBUG: No oauth_state in session, redirecting to login")
-        response.set_data(redirect(url_for('login')).get_data())
+        response = redirect(url_for('login'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
     
     # Parse the authorization response
@@ -172,24 +181,18 @@ def auth_callback():
     
     if 'error' in query_params:
         print(f"DEBUG: Error from Azure AD: {query_params['error'][0]}")
-        response.set_data(f"Authentication error: {query_params['error'][0]}")
+        return f"Authentication error: {query_params['error'][0]}", 400
-        response.status_code = 400
-        return response
     
     if 'code' not in query_params or 'state' not in query_params:
         print("DEBUG: Invalid authorization response - missing code or state")
-        response.set_data("Invalid authorization response")
+        return "Invalid authorization response", 400
-        response.status_code = 400
-        return response
     
     code = query_params['code'][0]
     state = query_params['state'][0]
     
     if state != session['oauth_state']:
         print(f"DEBUG: State mismatch: {state} != {session['oauth_state']}")
-        response.set_data("State mismatch")
+        return "State mismatch", 400
-        response.status_code = 400
-        return response
     
     # Exchange code for token using direct HTTP request with PKCE
     import requests
@@ -217,9 +220,7 @@ def auth_callback():
         
         if token_response.status_code != 200:
             print(f"DEBUG: Token exchange failed: {token_response.text}")
-            response.set_data(f"Token exchange failed: {token_response.text}")
+            return f"Token exchange failed: {token_response.text}", 400
-            response.status_code = 400
-            return response
         
         token = token_response.json()
         print(f"DEBUG: Token received successfully")
@@ -242,14 +243,15 @@ def auth_callback():
         session.pop('code_verifier', None)
         
         print("DEBUG: Authentication successful, redirecting to index")
-        response.set_data(redirect(url_for('index')).get_data())
+        response = redirect(url_for('index'))
+        response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Expires'] = '0'
         return response
         
     except requests.exceptions.RequestException as e:
         print(f"DEBUG: Request error during token exchange: {e}")
-        response.set_data(f"Authentication service error: {str(e)}")
+        return f"Authentication service error: {str(e)}", 500
-        response.status_code = 500
-        return response
 
 @app.route('/logout')
 def logout():