From 9ba1ae1ced641c13ff16e771ba313ac705df9008 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?=
 <adrianjpr@gmail.com>
Date: Mon, 30 Jun 2025 16:15:25 +0200
Subject: [PATCH] restore: change api redirect (#8138)

---
 api/src/backend/api/v1/urls.py        | 5 +++--
 api/src/backend/api/v1/views.py       | 7 +++++--
 api/src/backend/config/django/base.py | 3 ---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/api/src/backend/api/v1/urls.py b/api/src/backend/api/v1/urls.py
index bd5b8b60d1..40feee7979 100644
--- a/api/src/backend/api/v1/urls.py
+++ b/api/src/backend/api/v1/urls.py
@@ -128,8 +128,7 @@ urlpatterns = [
     path(
         "auth/saml/initiate/", SAMLInitiateAPIView.as_view(), name="api_saml_initiate"
     ),
-    # Allauth SAML endpoints for tenants
-    path("accounts/", include("allauth.urls")),
+    # Custom SAML endpoints (must come before allauth.urls)
     path(
         "accounts/saml/<organization_slug>/login/",
         CustomSAMLLoginView.as_view(),
@@ -140,6 +139,8 @@ urlpatterns = [
         TenantFinishACSView.as_view(),
         name="saml_finish_acs",
     ),
+    # Allauth SAML endpoints for tenants
+    path("accounts/", include("allauth.urls")),
     path("tokens/saml", SAMLTokenValidateView.as_view(), name="token-saml"),
     path("tokens/google", GoogleSocialLoginView.as_view(), name="token-google"),
     path("tokens/github", GithubSocialLoginView.as_view(), name="token-github"),
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 799b1b5f2b..4ea380e9d0 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -1,6 +1,7 @@
 import glob
 import os
 from datetime import datetime, timedelta, timezone
+from urllib.parse import urljoin
 
 import sentry_sdk
 from allauth.socialaccount.models import SocialAccount, SocialApp
@@ -485,10 +486,12 @@ class SAMLInitiateAPIView(GenericAPIView):
                 status=status.HTTP_403_FORBIDDEN,
             )
 
-        relative = reverse(
+        # Build the SAML login URL using the configured API host
+        api_host = os.getenv("API_BASE_URL")
+        login_path = reverse(
             "saml_login", kwargs={"organization_slug": config.email_domain}
         )
-        login_url = request.build_absolute_uri(relative)
+        login_url = urljoin(api_host, login_path)
 
         return redirect(login_url)
 
diff --git a/api/src/backend/config/django/base.py b/api/src/backend/config/django/base.py
index c7aea17c72..47c6320ce1 100644
--- a/api/src/backend/config/django/base.py
+++ b/api/src/backend/config/django/base.py
@@ -248,6 +248,3 @@ X_FRAME_OPTIONS = "DENY"
 SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
 
 DJANGO_DELETION_BATCH_SIZE = env.int("DJANGO_DELETION_BATCH_SIZE", 5000)
-
-# This is needed to forward the host header when defined
-USE_X_FORWARDED_HOST = True