From a196e8380133fc43170d30f167c03e9c5584e61f Mon Sep 17 00:00:00 2001
From: Tim Otten <totten@civicrm.org>
Date: Tue, 23 Feb 2021 02:50:39 -0800
Subject: [PATCH] authx - If using auto-login, then use a redirect to hide the
 `?_authx=...` gunk

---
 ext/authx/authx.php                           | 24 ++++++++++++++++++-
 .../tests/phpunit/Civi/Authx/AllFlowsTest.php |  3 ++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/ext/authx/authx.php b/ext/authx/authx.php
index 21224dfb9c..faaec6cef0 100644
--- a/ext/authx/authx.php
+++ b/ext/authx/authx.php
@@ -22,7 +22,12 @@ Civi::dispatcher()->addListener('civi.invoke.auth', function($e) {
     }
     elseif (!empty($params['_authxSes'])) {
       (new \Civi\Authx\Authenticator('auto'))->auth($e, $params['_authx'], TRUE);
-      _authx_redact(['_authx', '_authxSes']);
+      if ($_SERVER['REQUEST_METHOD'] === 'GET') {
+        _authx_reload(implode('/', $e->args), $_SERVER['QUERY_STRING']);
+      }
+      else {
+        _authx_redact(['_authx', '_authxSes']);
+      }
     }
     else {
       (new \Civi\Authx\Authenticator('param'))->auth($e, $params['_authx']);
@@ -52,6 +57,23 @@ function _authx_redact(array $keys) {
   }
 }
 
+/**
+ * Reload the current page-view.
+ *
+ * @param string $route
+ * @param string $queryString
+ */
+function _authx_reload($route, $queryString) {
+  parse_str($queryString, $query);
+  foreach (array_keys($query) as $key) {
+    if (CRM_Utils_String::startsWith($key, '_authx')) {
+      unset($query[$key]);
+    }
+  }
+  $url = CRM_Utils_System::url($route, $query, TRUE, NULL, FALSE, CRM_Core_Config::singleton()->userSystem->isFrontEndPage());
+  CRM_Utils_System::redirect($url);
+}
+
 /**
  * Implements hook_civicrm_config().
  *
diff --git a/ext/authx/tests/phpunit/Civi/Authx/AllFlowsTest.php b/ext/authx/tests/phpunit/Civi/Authx/AllFlowsTest.php
index ae3e6a164f..eb6eff39b7 100644
--- a/ext/authx/tests/phpunit/Civi/Authx/AllFlowsTest.php
+++ b/ext/authx/tests/phpunit/Civi/Authx/AllFlowsTest.php
@@ -253,8 +253,9 @@ class AllFlowsTest extends \PHPUnit\Framework\TestCase implements EndToEndInterf
     $request = $this->applyAuth($this->requestMyContact(), $credType, $flowType, $this->getDemoCID());
 
     \Civi::settings()->set("authx_{$flowType}_cred", [$credType]);
+    $this->assertEquals(0, $cookieJar->count());
     $response = $http->send($request);
-    $this->assertHasCookies($response);
+    $this->assertTrue($cookieJar->count() >= 1);
     $this->assertMyContact($this->getDemoCID(), $this->getDemoUID(), $response);
 
     // FIXME: Assert that re-using cookies yields correct result.
-- 
2.25.1