fix(device): redirect external-SSO completion to web-origin /device (WTA-438)

api/controllers/openapi/oauth_device_sso.py

@@ -82,6 +82,13 @@ def _trusted_origin() -> str:
     return base
 
 
+def _device_url(query: str) -> str:
+    # /device is served by the web frontend, not this API origin — a relative
+    # redirect would dead-end on the API host in split-origin deployments.
+    base = dify_config.CONSOLE_WEB_URL.rstrip("/")
+    return f"{base}/device{query}"
+
+
 @bp.route("/oauth/device/sso-initiate", methods=["GET"])
 @enterprise_only
 @rate_limit(LIMIT_SSO_INITIATE_PER_IP)
@@ -170,7 +177,7 @@ def sso_complete():
             _RejectedClaims(subject_email=claims.email, subject_issuer=claims.issuer),
             reason="email_belongs_to_dify_account",
         )
-        return redirect("/device?sso_error=email_belongs_to_dify_account", code=302)
+        return redirect(_device_url("?sso_error=email_belongs_to_dify_account"), code=302)
 
     iss = _trusted_origin()
     cookie_value, _ = mint_approval_grant(
@@ -181,7 +188,7 @@ def sso_complete():
         user_code=user_code,
     )
 
-    resp = redirect("/device?sso_verified=1", code=302)
+    resp = redirect(_device_url("?sso_verified=1"), code=302)
     resp.set_cookie(**approval_grant_cookie_kwargs(cookie_value))
     return resp
 

api/tests/unit_tests/controllers/openapi/test_device_sso.py

@@ -77,3 +77,19 @@ def test_sso_complete_idp_callback_url_uses_canonical_path():
     from controllers.openapi import oauth_device_sso
 
     assert oauth_device_sso._SSO_COMPLETE_PATH == "/openapi/v1/oauth/device/sso-complete"
+
+
+def test_device_url_uses_console_web_url_when_set(monkeypatch):
+    from configs import dify_config
+    from controllers.openapi import oauth_device_sso
+
+    monkeypatch.setattr(dify_config, "CONSOLE_WEB_URL", "https://web.example.com")
+    assert oauth_device_sso._device_url("?sso_verified=1") == "https://web.example.com/device?sso_verified=1"
+
+
+def test_device_url_strips_trailing_slash(monkeypatch):
+    from configs import dify_config
+    from controllers.openapi import oauth_device_sso
+
+    monkeypatch.setattr(dify_config, "CONSOLE_WEB_URL", "https://web.example.com/")
+    assert oauth_device_sso._device_url("?sso_error=x") == "https://web.example.com/device?sso_error=x"