fix(sso): derive the SSO callback URL during render

`callbackUrl` was seeded into `useState('/workspace')` and overwritten from
a `useEffect` that read `searchParams`, so the first painted frame always
carried the default. On any deep link with `?callbackUrl=`, the "Sign in
with email" and "Sign up" links briefly pointed at `/workspace` instead of
the requested destination, and a click landing in that window navigated to
the wrong place.

- derive `callbackUrl` from `searchParams` during render; the validation
  gate is unchanged, so an off-origin or malformed value still falls back
  to `/workspace`
- keep the warning for a rejected value in an effect, now keyed on the
  param itself rather than the `searchParams` object, so it fires once per
  actual change instead of once per identity change
- add first-frame tests via `renderToString`, which runs no effects and so
  pins exactly the window the old code got wrong

Author: waleedlatif1

apps/sim/ee/sso/components/sso-form.test.tsx

@@ -0,0 +1,80 @@
+/**
+ * @vitest-environment jsdom
+ */
+import type { ReactNode } from 'react'
+import { renderToString } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockUseSearchParams } = vi.hoisted(() => ({
+  mockUseSearchParams: vi.fn(),
+}))
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn() }),
+  useSearchParams: mockUseSearchParams,
+}))
+
+vi.mock('next/link', () => ({
+  default: ({ href, children }: { href: string; children?: ReactNode }) => (
+    <a href={href}>{children}</a>
+  ),
+}))
+
+vi.mock('@sim/emcn', () => ({
+  Button: ({ children }: { children?: ReactNode }) => <button type='button'>{children}</button>,
+  Input: () => <input />,
+  Label: ({ children }: { children?: ReactNode }) => <span>{children}</span>,
+  cn: (...values: unknown[]) => values.filter(Boolean).join(' '),
+}))
+
+vi.mock('@/lib/auth/auth-client', () => ({
+  client: { signIn: { sso: vi.fn() } },
+}))
+
+vi.mock('@/app/(auth)/components', () => ({
+  AuthSubmitButton: ({ children }: { children?: ReactNode }) => (
+    <button type='submit'>{children}</button>
+  ),
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  getEnv: () => 'true',
+  isFalsy: (value: unknown) => value === undefined || value === 'false',
+}))
+
+import SSOForm from '@/ee/sso/components/sso-form'
+
+function renderFirstFrame(search: string): string {
+  mockUseSearchParams.mockReturnValue(new URLSearchParams(search))
+  return renderToString(<SSOForm />)
+}
+
+/**
+ * `renderToString` produces the markup of the first frame with no effects run,
+ * which is exactly the window in which a callback URL seeded from an effect is
+ * still the `/workspace` default.
+ */
+describe('SSOForm callback URL', () => {
+  beforeEach(() => {
+    mockUseSearchParams.mockReset()
+  })
+
+  it('carries a valid callbackUrl on the first rendered frame', () => {
+    const html = renderFirstFrame('callbackUrl=/workspace/abc/w/xyz')
+
+    expect(html).toContain(encodeURIComponent('/workspace/abc/w/xyz'))
+  })
+
+  it('falls back to /workspace when no callbackUrl is present', () => {
+    const html = renderFirstFrame('')
+
+    expect(html).toContain(`/login?callbackUrl=${encodeURIComponent('/workspace')}`)
+  })
+
+  it('rejects an off-origin callbackUrl and falls back to /workspace', () => {
+    const html = renderFirstFrame('callbackUrl=https://evil.example.com/steal')
+
+    expect(html).not.toContain('evil.example.com')
+    expect(html).toContain(`/login?callbackUrl=${encodeURIComponent('/workspace')}`)
+  })
+})

apps/sim/ee/sso/components/sso-form.tsx

@@ -36,21 +36,27 @@ export default function SSOForm() {
   const [email, setEmail] = useState('')
   const [emailErrors, setEmailErrors] = useState<string[]>([])
   const [showEmailValidationError, setShowEmailValidationError] = useState(false)
-  const [callbackUrl, setCallbackUrl] = useState('/workspace')
 
   const emailEnabled = !isFalsy(getEnv('NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED'))
 
+  /**
+   * Derived during render rather than seeded into state from an effect: the
+   * first painted frame otherwise carries the `/workspace` default, so the
+   * "Sign in with email" and "Sign up" links briefly point at the wrong
+   * destination on any deep link carrying `?callbackUrl=`.
+   */
+  const callbackParam = searchParams?.get('callbackUrl') ?? null
+  const isCallbackValid = callbackParam !== null && validateCallbackUrl(callbackParam)
+  const callbackUrl = callbackParam !== null && isCallbackValid ? callbackParam : '/workspace'
+
   useEffect(() => {
-    if (searchParams) {
-      const callback = searchParams.get('callbackUrl')
-      if (callback) {
-        if (validateCallbackUrl(callback)) {
-          setCallbackUrl(callback)
-        } else {
-          logger.warn('Invalid callback URL detected and blocked:', { url: callback })
-        }
-      }
+    if (callbackParam !== null && !isCallbackValid) {
+      logger.warn('Invalid callback URL detected and blocked:', { url: callbackParam })
+    }
+  }, [callbackParam, isCallbackValid])
 
+  useEffect(() => {
+    if (searchParams) {
       const emailParam = searchParams.get('email')
       if (emailParam) {
         setEmail(emailParam)