VPR-151 fix(auth): handle /2 PathBase in welcome/login redirect guards

Three guards in HomeController matched root-relative literals against the
un-stripped ReturnUrl, so they misbehaved only under the /2 subpath
deployment (TEST/PROD), not local dev:

- Login's /api guard let a "/2/api/..." ReturnUrl bypass it and be
  forwarded to CAS; strip the PathBase before the check.
- Welcome's redirect-loop guard sent "/2/welcome" and "/2/login" to CAS
  instead of nulling them; strip before the check.
- Authenticated Welcome (no ReturnUrl) and the CasLogin fallback
  redirected to "/" (the legacy ColdFusion root) instead of "~/" (the
  /2 app root).

Author: rlorenzo

VueApp/src/composables/__tests__/require-login.test.ts

@@ -10,44 +10,61 @@ function withBase(base: string, run: () => void): void {
     }
 }
 
+describe("buildLoginUrl endpoint selection", () => {
+    it("defaults to the welcome splash", () => {
+        withBase("/", () => {
+            expect(buildLoginUrl("/Effort")).toBe("/welcome?ReturnUrl=%2FEffort")
+        })
+    })
+
+    it("goes straight to CAS when the login endpoint is requested", () => {
+        // Explicit "Log in" buttons skip the splash so a deliberate click isn't met
+        // with a second sign-in screen.
+        withBase("/", () => {
+            expect(buildLoginUrl("/Effort", "login")).toBe("/login?ReturnUrl=%2FEffort")
+        })
+    })
+})
+
 describe("buildLoginUrl application base handling", () => {
     it("emits root-relative paths when the app is served at the domain root", () => {
         withBase("/", () => {
-            expect(buildLoginUrl("/CTS/")).toBe("/login?ReturnUrl=%2FCTS%2F")
+            expect(buildLoginUrl("/CTS/")).toBe("/welcome?ReturnUrl=%2FCTS%2F")
         })
     })
 
     it("keeps the /2 base for the subpath deployment", () => {
         // TEST/PROD run VIPER 2 under a "/2" PathBase; dropping it escapes to the legacy site.
         withBase("/2/", () => {
-            expect(buildLoginUrl("/2/CTS/")).toBe("/2/login?ReturnUrl=%2F2%2FCTS%2F")
+            expect(buildLoginUrl("/2/CTS/")).toBe("/2/welcome?ReturnUrl=%2F2%2FCTS%2F")
+            expect(buildLoginUrl("/2/CTS/", "login")).toBe("/2/login?ReturnUrl=%2F2%2FCTS%2F")
         })
     })
 
     it("inserts the separator when the base is configured without a trailing slash", () => {
-        // Guards the "/2login" regression: the base is normalized, then joined with "/".
+        // Guards the "/2welcome" regression: the base is normalized, then joined with "/".
         withBase("/2", () => {
-            expect(buildLoginUrl("/2/CTS/")).toBe("/2/login?ReturnUrl=%2F2%2FCTS%2F")
+            expect(buildLoginUrl("/2/CTS/")).toBe("/2/welcome?ReturnUrl=%2F2%2FCTS%2F")
         })
     })
 
     it("collapses a base with duplicate trailing slashes", () => {
         withBase("/2///", () => {
-            expect(buildLoginUrl("/2/CTS/")).toBe("/2/login?ReturnUrl=%2F2%2FCTS%2F")
+            expect(buildLoginUrl("/2/CTS/")).toBe("/2/welcome?ReturnUrl=%2F2%2FCTS%2F")
         })
     })
 })
 
 describe("buildLoginUrl invalid return paths", () => {
     it("falls back to the application root instead of forwarding an off-site path", () => {
         withBase("/", () => {
-            expect(buildLoginUrl("https://evil.example/x")).toBe("/login?ReturnUrl=%2F")
+            expect(buildLoginUrl("https://evil.example/x")).toBe("/welcome?ReturnUrl=%2F")
         })
     })
 
     it("falls back to the base-prefixed root in the subpath deployment", () => {
         withBase("/2/", () => {
-            expect(buildLoginUrl("https://evil.example/x")).toBe("/2/login?ReturnUrl=%2F2%2F")
+            expect(buildLoginUrl("https://evil.example/x")).toBe("/2/welcome?ReturnUrl=%2F2%2F")
         })
     })
 })
@@ -56,7 +73,7 @@ describe("buildLoginUrl return paths carrying a query string", () => {
     it("round-trips the query string (the CTS landing forwards location.search)", () => {
         withBase("/2/", () => {
             expect(buildLoginUrl("/2/CTS/?sendBackTo=/cts/epa")).toBe(
-                "/2/login?ReturnUrl=%2F2%2FCTS%2F%3FsendBackTo%3D%2Fcts%2Fepa",
+                "/2/welcome?ReturnUrl=%2F2%2FCTS%2F%3FsendBackTo%3D%2Fcts%2Fepa",
             )
         })
     })
@@ -68,14 +85,14 @@ describe("buildLoginUrl return paths carrying a query string", () => {
         // the app root after sign-in.
         withBase("/2/", () => {
             expect(buildLoginUrl("/2/CTS/?sendBackTo=%2Fcts%2Fepa")).toBe(
-                "/2/login?ReturnUrl=%2F2%2FCTS%2F%3FsendBackTo%3D%252Fcts%252Fepa",
+                "/2/welcome?ReturnUrl=%2F2%2FCTS%2F%3FsendBackTo%3D%252Fcts%252Fepa",
             )
         })
     })
 
     it("keeps a return path whose query carries encoded dots", () => {
         withBase("/2/", () => {
-            expect(buildLoginUrl("/2/CTS/?q=%2e%2e")).toBe("/2/login?ReturnUrl=%2F2%2FCTS%2F%3Fq%3D%252e%252e")
+            expect(buildLoginUrl("/2/CTS/?q=%2e%2e")).toBe("/2/welcome?ReturnUrl=%2F2%2FCTS%2F%3Fq%3D%252e%252e")
         })
     })
 })

test/Controllers/HomeControllerTests.cs

@@ -110,11 +110,67 @@ private void Arrange(bool authenticated)
     [InlineData("/login", true)]
     [InlineData("/LOGIN?ReturnUrl=/x", true)]
     [InlineData("/welcome#frag", true)]
+    [InlineData("/caslogin", true)] // re-entering the ticket handler without a ticket would 403
+    [InlineData("/CasLogin/", true)]
     [InlineData("/RAPS/Roles", false)]
     [InlineData("/welcomepage", false)]
-    public void IsWelcomeOrLoginPath_DetectsLoopTargets(string? url, bool expected)
+    [InlineData("/caslogins", false)]
+    public void IsAuthEntryPath_DetectsLoopTargets(string? url, bool expected)
     {
-        Assert.Equal(expected, HomeController.IsWelcomeOrLoginPath(url));
+        Assert.Equal(expected, HomeController.IsAuthEntryPath(url));
+    }
+
+    // Parity with the Vue guard, which rejects "../" and any "%2e" outright. A dot-segment survives
+    // IsLocalUrl and the root-relative /api check, then resolves somewhere else once the browser
+    // follows it — including in the percent-encoded spellings the URL spec also resolves.
+    [Theory]
+    [InlineData(null, false)]
+    [InlineData("", false)]
+    [InlineData("/Effort/Reports", false)]
+    [InlineData("/Effort/..api/x", false)] // ".." only counts as a whole segment
+    [InlineData("/dots../x", false)]
+    [InlineData("/Effort/%2ename/x", false)] // encoded dot only counts as a whole segment too
+    [InlineData("/Effort/../api/secret", true)]
+    [InlineData("/2/Effort/../api/secret", true)]
+    [InlineData("/./api/secret", true)]
+    [InlineData("/Effort/..", true)]
+    [InlineData("/Effort/../api?tab=1", true)]
+    [InlineData("/Effort/%2e%2e/api/secret", true)] // browsers resolve the encoded form the same way
+    [InlineData("/Effort/%2E%2E/api/secret", true)] // and the match is ASCII case-insensitive
+    [InlineData("/Effort/.%2e/api/secret", true)] // mixed encoding counts as ".." too
+    [InlineData("/Effort/%2e./api/secret", true)]
+    [InlineData("/%2e/api/secret", true)]
+    public void ContainsDotSegment_DetectsTraversal(string? url, bool expected)
+    {
+        Assert.Equal(expected, HomeController.ContainsDotSegment(url));
+    }
+
+    // The single ReturnUrl contract shared by /welcome, /login and /CasLogin, exercised under a
+    // subpath deployment so the base-prefixed and "~/" spellings are covered in one place.
+    [Theory]
+    [InlineData("/Effort", true)]
+    [InlineData("/2/Effort", true)]
+    [InlineData("~/Effort", true)]
+    [InlineData("/2/Effort/Reports?year=2026", true)]
+    [InlineData("/welcomepage", true)] // near-match on an entry point is a normal page
+    [InlineData(null, false)]
+    [InlineData("", false)]
+    [InlineData("https://evil.com/phish", false)]
+    [InlineData("//evil.com", false)]
+    [InlineData("/welcome", false)] // redirect loop
+    [InlineData("/login", false)]
+    [InlineData("/caslogin", false)] // ticketless re-entry 403s a user who just signed in
+    [InlineData("/2/welcome", false)] // base-prefixed entry points must be caught too
+    [InlineData("/2/CasLogin/", false)]
+    [InlineData("~/welcome", false)] // app-relative spelling must not slip past
+    [InlineData("/Effort/../api/secret", false)]
+    [InlineData("/2/Effort/%2e%2e/api/secret", false)]
+    public void IsSafeReturnUrl_EnforcesSharedContract(string? returnUrl, bool expected)
+    {
+        Arrange(authenticated: false);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        Assert.Equal(expected, _controller.IsSafeReturnUrl(returnUrl));
     }
 
     // Splash appears only for the front door (an empty return path or the bare site root) and for a
@@ -258,6 +314,45 @@ public void Welcome_Anonymous_SubpathDeepLink_RedirectsToCasLogin()
         Assert.Equal("/2/ClinicalScheduler/rotation", redirect.RouteValues?["ReturnUrl"]);
     }
 
+    // Under a subpath deployment every unsafe ReturnUrl arrives base-prefixed, so the base has to come
+    // off before the guards run. Both classes are covered here: auth entry points that would loop (or
+    // 403 on a ticketless re-entry), and dot-segments the browser resolves elsewhere after the CAS round
+    // trip. In each case the splash renders with a null ReturnUrl rather than bouncing back out to CAS.
+    [Theory]
+    [InlineData("/2/welcome")]
+    [InlineData("/2/login")]
+    [InlineData("/2/Welcome/")]
+    [InlineData("/2/caslogin")] // would re-enter the ticket handler ticketless and 403 after a good sign-in
+    [InlineData("/Effort/../api/secret")]
+    [InlineData("/2/Effort/../api/secret")]
+    [InlineData("/2/Effort/%2e%2e/api/secret")] // browsers resolve the encoded spelling the same way
+    public void Welcome_Anonymous_SubpathUnsafeReturnUrl_DropsReturnUrl(string returnUrl)
+    {
+        Arrange(authenticated: false);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        var result = _controller.Welcome(returnUrl);
+
+        var view = Assert.IsType<ViewResult>(result);
+        Assert.Equal("Welcome", view.ViewName);
+        Assert.Null(view.ViewData["ReturnUrl"]);
+    }
+
+    // Authenticated welcome with no ReturnUrl under a subpath deployment redirects to "~/" so the app
+    // root keeps its PathBase ("/2/") instead of escaping to the domain root. Regression guard for the
+    // bare "/" that sent logged-in users out to the legacy site.
+    [Fact]
+    public void Welcome_Authenticated_NoReturnUrl_RedirectsToAppRelativeRoot()
+    {
+        Arrange(authenticated: true);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        var result = _controller.Welcome();
+
+        var redirect = Assert.IsType<LocalRedirectResult>(result);
+        Assert.Equal("~/", redirect.Url);
+    }
+
     // Anonymous users still get the Welcome view, but any ReturnUrl that is non-local
     // (open redirect) or points back at /welcome|/login (redirect loop) is dropped.
     [Theory]
@@ -288,6 +383,8 @@ public void Welcome_Authenticated_RedirectsToLocalReturnUrl()
         Assert.Equal("/Effort/Foo", redirect.Url);
     }
 
+    // App root is "~/" (not "/") so a subpath deployment keeps its PathBase ("/2/") rather than
+    // escaping to the domain root (the legacy site).
     [Theory]
     [InlineData("https://evil.com")]
     [InlineData(null)]
@@ -298,11 +395,28 @@ public void Welcome_Authenticated_RedirectsToRootWhenReturnUrlInvalidOrMissing(s
         var result = _controller.Welcome(returnUrl);
 
         var redirect = Assert.IsType<LocalRedirectResult>(result);
-        Assert.Equal("/", redirect.Url);
+        Assert.Equal("~/", redirect.Url);
+    }
+
+    // The /api guard matches the api segment case-insensitively (routing is case-insensitive) and
+    // on a segment boundary, so "/api", "/api/...", "/api?..." are rejected in any casing while
+    // non-API paths that merely start with "api" (e.g. "/apiary") pass through to CAS.
+    [Theory]
+    [InlineData("/api", true)]
+    [InlineData("/api/foo", true)]
+    [InlineData("/API/foo", true)]
+    [InlineData("/Api?x=1", true)]
+    [InlineData("/api#frag", true)]
+    [InlineData("/apiary", false)]
+    [InlineData("/", false)]
+    public void IsApiPath_MatchesApiSegmentCaseInsensitivelyOnBoundary(string url, bool expected)
+    {
+        Assert.Equal(expected, HomeController.IsApiPath(url));
     }
 
     [Theory]
     [InlineData("/api/secret")]
+    [InlineData("/API/secret")] // routing is case-insensitive, so the guard must be too
     [InlineData("~/api/secret")] // app-relative form must not bypass the /api guard
     public void Login_RejectsApiReturnUrl_WithUnauthorized(string returnUrl)
     {
@@ -313,6 +427,35 @@ public void Login_RejectsApiReturnUrl_WithUnauthorized(string returnUrl)
         Assert.IsType<UnauthorizedResult>(result);
     }
 
+    // A non-API path that merely starts with "api" is not caught by the guard; it proceeds to the
+    // normal CAS redirect.
+    [Fact]
+    public void Login_ForwardsNonApiPathStartingWithApiToCas()
+    {
+        Arrange(authenticated: false);
+
+        var result = _controller.Login("/apiary");
+
+        Assert.IsType<RedirectResult>(result);
+    }
+
+    // Under a subpath deployment the /api ReturnUrl arrives base-prefixed ("/2/api/..."). The base is
+    // stripped before the guard so it is still rejected and never forwarded to CAS. Regression guard for
+    // the pre-strip /api check that a "/2/api/..." ReturnUrl slipped past.
+    [Theory]
+    [InlineData("/2/api/secret")]
+    [InlineData("/2/API/secret")] // base-prefixed + mixed case must not bypass the guard
+    [InlineData("~/2/api/secret")] // app-relative + base-prefixed must not bypass the guard either
+    public void Login_RejectsSubpathApiReturnUrl_WithUnauthorized(string returnUrl)
+    {
+        Arrange(authenticated: false);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        var result = _controller.Login(returnUrl);
+
+        Assert.IsType<UnauthorizedResult>(result);
+    }
+
     [Theory]
     [InlineData("https://evil.com/phish")]
     [InlineData("//evil.com")]
@@ -325,4 +468,63 @@ public void Login_DoesNotForwardNonLocalReturnUrl(string returnUrl)
         var redirect = Assert.IsType<RedirectResult>(result);
         Assert.DoesNotContain("evil.com", redirect.Url, StringComparison.OrdinalIgnoreCase);
     }
+
+    // A dot-segment ReturnUrl passes IsLocalUrl and the root-relative /api check, but the browser
+    // resolves it after the CAS round trip: "/2/Effort/../api/secret" lands on "/2/api/secret" and
+    // dumps the user on a JSON 401. Dropped up front instead, matching the Vue guard.
+    // Asserting on "Effort" rather than "api/secret": the ReturnUrl is double URL-encoded into the CAS
+    // service URL, so any assertion containing a slash would pass even with the guard removed.
+    [Theory]
+    [InlineData("/Effort/../api/secret")]
+    [InlineData("/2/Effort/../api/secret")]
+    [InlineData("~/Effort/../api/secret")]
+    [InlineData("/2/Effort/%2e%2e/api/secret")]
+    public void Login_DoesNotForwardDotSegmentReturnUrl(string returnUrl)
+    {
+        Arrange(authenticated: false);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        var result = _controller.Login(returnUrl);
+
+        var redirect = Assert.IsType<RedirectResult>(result);
+        Assert.DoesNotContain("Effort", redirect.Url, StringComparison.OrdinalIgnoreCase);
+    }
+
+    // /login applies the same auth-entry guard as /welcome, so "/login?ReturnUrl=/welcome" cannot
+    // bounce the user back to the splash after a successful sign-in. ("/login" and "/caslogin" are
+    // covered by IsSafeReturnUrl above: both are substrings of the CAS service URL, so they can't be
+    // asserted against the redirect target here.)
+    [Theory]
+    [InlineData("/welcome")]
+    [InlineData("/2/welcome")]
+    [InlineData("~/welcome")]
+    public void Login_DoesNotForwardAuthEntryReturnUrl(string returnUrl)
+    {
+        Arrange(authenticated: false);
+        _controller.HttpContext.Request.PathBase = "/2";
+
+        var result = _controller.Login(returnUrl);
+
+        var redirect = Assert.IsType<RedirectResult>(result);
+        Assert.DoesNotContain("welcome", redirect.Url, StringComparison.OrdinalIgnoreCase);
+    }
+
+    // The anonymous "/" splash must carry the same no-store headers as /welcome, which gets them from
+    // [ResponseCache]. Both now route through the shared WelcomeSplash helper.
+    [Fact]
+    public void Index_And_Welcome_Anonymous_EmitMatchingNoStoreHeaders()
+    {
+        Arrange(authenticated: false);
+        _controller.Index();
+        var indexCacheControl = _controller.Response.Headers["Cache-Control"].ToString();
+        var indexPragma = _controller.Response.Headers["Pragma"].ToString();
+
+        Arrange(authenticated: false);
+        _controller.Welcome();
+
+        Assert.Equal("no-store,no-cache", indexCacheControl);
+        Assert.Equal("no-cache", indexPragma);
+        Assert.Equal(indexCacheControl, _controller.Response.Headers["Cache-Control"].ToString());
+        Assert.Equal(indexPragma, _controller.Response.Headers["Pragma"].ToString());
+    }
 }