Fixing redirection issue for logged-in users

[cassiozareck]

This PR addresses an issue where logged-in users get redirected to the homepage when trying to access a URL with the redirect_to parameter. The issue was traced back to a middleware function in services/auth/middleware.go that redirects logged-in users to the homepage. This function didn't account the redirect_to parameter.

The fix modifies the middleware function to check for this case and redirect the user to the specified URL instead of the homepage.

Closes: #26005

[puni9869]

@wxiaoguang need your feedback for this change.

[wxiaoguang]

I haven't understood why this change works.

In my mind, the straight fix could be:

1. Move the m.Get("/login", auth.SignIn) out from the reqSignOut
2. In auth.SignIn, if the current user "IsSigned", then redirect

[puni9869]

I haven't understood why this change works.

In my mind, the straight fix could be:

1. Move the m.Get("/login", auth.SignIn) out from the reqSignOut
2. In auth.SignIn, if the current user "IsSigned", then redirect

Thats what I thought

[cassiozareck]

I haven't thought about it before, but your suggestion makes a lot more sense than changing the middleware itself. I've updated the PR accordingly. Now, I've moved the login route outside of the reqSignOut middleware and discarded the old changes.

The auth.SignIn route handler now checks if the user is logged in. If the user is logged in, it redirects them. If the URL doesn't have the redirect_to parameter, it simply redirects to the / route. This is useful in scenarios where the user wants to access the redirect page only if they're logged in.

[wxiaoguang]

Thank you, overall it looks good to me, while I think the "POST" method should be kept in the "reqSignOut"

[puni9869]

Thanks cassiozareck for these changes. 💯

[cassiozareck]

Thank you, overall it looks good to me, while I think the "POST" method should be kept in the "reqSignOut"

I tried that first but the login wasn't being saved after login probably because it expects the user should had first signed out to save the post login.
Thanks for the help guys I'll keep contributing for Gitea.

[wxiaoguang]

Sorry maybe I misunderstood the problem. If "SignInPost" also needs to handle "redirect_to", IMO it needs a slightly different approach to keep the old behavior, I will try to figure it out.