From 3038461fb75e46a7b1fa0a30d23fe8caf655131c Mon Sep 17 00:00:00 2001
From: Bruno Bernardino <me@brunobernardino.com>
Date: Fri, 6 Jun 2025 11:30:04 +0100
Subject: [PATCH] Fix WebDAV discovery

Also fix stricter SSO providers which require the paths to match in `redirect_uri`.

Probably fixes #66
---
 lib/models/oidc.ts     | 6 +++---
 routes/_middleware.tsx | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/models/oidc.ts b/lib/models/oidc.ts
index a217f7b..2a0478b 100644
--- a/lib/models/oidc.ts
+++ b/lib/models/oidc.ts
@@ -21,15 +21,15 @@ interface OidcJwtIdToken extends Record<string, string | undefined> {
   sub?: string;
 }
 
+const redirectUrlPath = '/oidc/callback';
+
 export class OidcModel {
   static async getSignInUrl(
     {
       requestPermissions,
-      redirectUrlPath = '/oidc/callback',
       extraState = {},
     }: {
       requestPermissions: string[];
-      redirectUrlPath?: string;
       extraState?: OidcExtraState;
     },
   ): Promise<string> {
@@ -154,7 +154,7 @@ export class OidcModel {
 
     const tokens = await openIdClient.authorizationCodeGrant(
       oidcConfig,
-      new URL(`${baseUrl}?${urlSearchParams.toString()}`),
+      new URL(`${baseUrl}${redirectUrlPath}?${urlSearchParams.toString()}`),
       {
         pkceCodeVerifier: expectedCodeVerifier,
         expectedState,
diff --git a/routes/_middleware.tsx b/routes/_middleware.tsx
index 182fca7..6183a16 100644
--- a/routes/_middleware.tsx
+++ b/routes/_middleware.tsx
@@ -5,7 +5,9 @@ import { getDataFromRequest } from '/lib/auth.ts';
 
 export const handler = [
   async function handleCors(request: Request, context: FreshContext<FreshContextState>) {
-    if (request.method == 'OPTIONS') {
+    const path = new URL(request.url).pathname;
+
+    if (request.method == 'OPTIONS' && path !== '/dav' && !path.startsWith('/dav/')) {
       const response = new Response(null, {
         status: 204,
       });