restore: change api redirect (#8138)

api/src/backend/api/v1/urls.py

@@ -128,8 +128,7 @@ urlpatterns = [
     path(
         "auth/saml/initiate/", SAMLInitiateAPIView.as_view(), name="api_saml_initiate"
     ),
-    # Allauth SAML endpoints for tenants
-    path("accounts/", include("allauth.urls")),
+    # Custom SAML endpoints (must come before allauth.urls)
     path(
         "accounts/saml/<organization_slug>/login/",
         CustomSAMLLoginView.as_view(),
@@ -140,6 +139,8 @@ urlpatterns = [
         TenantFinishACSView.as_view(),
         name="saml_finish_acs",
     ),
+    # Allauth SAML endpoints for tenants
+    path("accounts/", include("allauth.urls")),
     path("tokens/saml", SAMLTokenValidateView.as_view(), name="token-saml"),
     path("tokens/google", GoogleSocialLoginView.as_view(), name="token-google"),
     path("tokens/github", GithubSocialLoginView.as_view(), name="token-github"),

api/src/backend/api/v1/views.py

@@ -1,6 +1,7 @@
 import glob
 import os
 from datetime import datetime, timedelta, timezone
+from urllib.parse import urljoin
 
 import sentry_sdk
 from allauth.socialaccount.models import SocialAccount, SocialApp
@@ -485,10 +486,12 @@ class SAMLInitiateAPIView(GenericAPIView):
                 status=status.HTTP_403_FORBIDDEN,
             )
 
-        relative = reverse(
+        # Build the SAML login URL using the configured API host
+        api_host = os.getenv("API_BASE_URL")
+        login_path = reverse(
             "saml_login", kwargs={"organization_slug": config.email_domain}
         )
-        login_url = request.build_absolute_uri(relative)
+        login_url = urljoin(api_host, login_path)
 
         return redirect(login_url)
 

api/src/backend/config/django/base.py

@@ -248,6 +248,3 @@ X_FRAME_OPTIONS = "DENY"
 SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
 
 DJANGO_DELETION_BATCH_SIZE = env.int("DJANGO_DELETION_BATCH_SIZE", 5000)
-
-# This is needed to forward the host header when defined
-USE_X_FORWARDED_HOST = True