feat: add RedirectUriPrefix support to OpenIdConnectConfiguration for sub-path deployments

[IbrahimMNada]

Purpose

Allow applications using the ElsaLogin OIDC flow to configure a path prefix for the redirect_uri,
enabling correct authentication in sub-path deployments where the IdP enforces a specific redirect_uri format.

Scope

Select one primary concern:

• Bug fix (behavior change)
• Refactor (no behavior change)
• Documentation update
• Formatting / code cleanup
• Dependency / build update
• New feature

If this PR includes multiple unrelated concerns, please split it before requesting review.

---

This produces https://myapp.com/workflow/signin-oidc instead of https://myapp.com/signin-oidc.
When not set, behaviour is unchanged — defaults to {origin}/signin-oidc.

---

Verification

Steps:

1. Deploy or configure the Elsa Studio host behind a reverse proxy or sub-path (e.g., /workflow).
2. Set Authentication:ElsaLogin:RedirectUriPrefix to /workflow in appsettings.json.
3. Register https://myapp.com/workflow/signin-oidc as an allowed redirect URI in your IdP
   (e.g., Azure AD, Keycloak).
4. Navigate to Elsa Studio and trigger the OIDC login flow.

Expected outcome: The authorization request is sent with
redirect_uri=https://myapp.com/workflow/signin-oidc, the IdP accepts it, and the user is
successfully authenticated.

---

Screenshots / Recordings (if applicable)

N/A — No UI changes. This is a configuration and service-layer change only.

---

Checklist

• The PR is focused on a single concern
• Commit messages follow the recommended convention
• Tests added or updated (if applicable)
• Documentation updated (if applicable)
• No unrelated cleanup included
• All tests pass

[greptile-apps]

Greptile Summary

This PR adds a RedirectUriPrefix configuration property to OpenIdConnectConfiguration so that applications deployed under a sub-path (e.g., behind a reverse proxy at /workflow) can produce the correct redirect_uri for OIDC flows without any behavior change when the property is unset.

• Adds nullable RedirectUriPrefix property to OpenIdConnectConfiguration with XML documentation explaining the sub-path use case.
• Updates both RedirectToAuthorizationServer and ReceiveAuthorizationCode in OpenIdConnectAuthorizationService to consistently insert the prefix between the origin and /signin-oidc, keeping both usages in sync so the token exchange redirect_uri always matches the initial authorization request.

Confidence Score: 4/5

Safe to merge for typical deployments; the only risk is a misconfigured prefix (missing leading slash) producing a silently broken redirect URI.

Both call sites are updated consistently, and the default behaviour (empty prefix) is unchanged. The main gap is that there is no guard ensuring RedirectUriPrefix starts with /, so a value like "workflow" would produce a malformed URI and cause OIDC login to break with an opaque IdP error.

OpenIdConnectAuthorizationService.cs — the prefix is spliced in without any normalization; a missing leading / will silently corrupt both the authorization request and the token-exchange redirect URI.

Important Files Changed

Filename	Overview
src/modules/Elsa.Studio.Login/Models/OpenIdConnectConfiguration.cs	Adds nullable RedirectUriPrefix property; XML doc comment uses non-standard <b> tag and has a double space, but the property itself is correct.
src/modules/Elsa.Studio.Login/Services/OpenIdConnectAuthorizationService.cs	Consistently inserts RedirectUriPrefix in both RedirectToAuthorizationServer and ReceiveAuthorizationCode; no validation that the prefix starts with /, which can silently produce a malformed URI.

Sequence Diagram

sequenceDiagram
    participant User
    participant ElsaStudio as Elsa Studio (Blazor)
    participant IdP as Identity Provider

    User->>ElsaStudio: Navigate to protected page
    ElsaStudio->>ElsaStudio: "Build redirect_uri: {origin} + RedirectUriPrefix + /signin-oidc"
    ElsaStudio->>IdP: "GET /authorize?redirect_uri=https://myapp.com/workflow/signin-oidc&..."
    IdP-->>User: Login page
    User->>IdP: Submit credentials
    IdP-->>ElsaStudio: "Redirect to https://myapp.com/workflow/signin-oidc?code=..."
    ElsaStudio->>ElsaStudio: ReceiveAuthorizationCode() re-builds same redirect_uri with prefix
    ElsaStudio->>IdP: POST /token (code + redirect_uri)
    IdP-->>ElsaStudio: Access / Refresh / ID tokens
    ElsaStudio-->>User: Authenticated, navigate to returnUrl

Loading

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
src/modules/Elsa.Studio.Login/Services/OpenIdConnectAuthorizationService.cs:24
**Missing leading-slash guard on `RedirectUriPrefix`**

If a user configures `RedirectUriPrefix` without a leading `/` (e.g., `"workflow"` instead of `"/workflow"`), the resulting URI will be malformed: `https://myapp.comworkflow/signin-oidc`. The IdP will reject it with an opaque "invalid redirect_uri" error that is hard to debug. Since the same expression is duplicated in both `RedirectToAuthorizationServer` and `ReceiveAuthorizationCode`, both methods are affected. Adding a trim/normalization step (e.g., ensuring the prefix starts with `/` when non-empty) or at least documenting the expectation in the XML comment would prevent this silent misconfiguration.

### Issue 2 of 2
src/modules/Elsa.Studio.Login/Models/OpenIdConnectConfiguration.cs:23-25
The XML documentation comment has two style issues: a double space in "can be set  before", and `<b>` is not a standard C# XML doc element (standard tags are `<c>`, `<para>`, `<em>`, etc.). The `<b>` tag will render inconsistently across documentation generators. Replacing it with `<c>` makes the example render correctly as a code fragment.

```suggestion
    /// <summary>
    /// A prefix to insert before <c>/signin-oidc</c> when constructing the redirect_uri for the authorization request.
    /// Useful for sub-path deployments behind a reverse proxy, e.g. setting this to <c>/workflow</c> produces
    /// <c>https://myapp.com/workflow/signin-oidc</c>. The value must start with <c>/</c>. When not set the redirect_uri
    /// defaults to <c>{origin}/signin-oidc</c>.
    /// </summary>
```

_{Reviews (1): Last reviewed commit: "remove space" | Re-trigger Greptile}