Decode configured OIDC prefixes too, not just the request path

A site_prefix containing a percent-encoded character (e.g. a space ->
%20) is stored encoded in protected_paths/public_paths. Decoding only the
request path made the decoded path fail to match the still-encoded prefix,
so protected pages (including the default ["/"]) became public. Decode
both sides. Adds regression tests.

Author: lovasoa

src/webserver/oidc.rs

@@ -140,15 +140,28 @@ impl TryFrom<&AppConfig> for OidcConfig {
 impl OidcConfig {
     #[must_use]
     pub fn is_public_path(&self, path: &str) -> bool {
-        // Percent-decode the request path before matching, so that an
-        // encoded protected prefix (e.g. "/%70rotected" == "/protected")
-        // is classified the same way the router resolves it once decoded.
-        // Otherwise an unauthenticated request could bypass the protected
-        // path rules while still executing the protected SQL file.
-        let decoded = percent_encoding::percent_decode_str(path).decode_utf8_lossy();
+        // Percent-decode before matching, so an encoded protected prefix
+        // (e.g. "/%70rotected" == "/protected") is classified the same way the
+        // router resolves it once decoded. Both the request path AND the
+        // configured prefixes are decoded: `site_prefix` may itself contain
+        // percent-encoded characters (e.g. a space -> "%20"), so the stored
+        // prefixes can be encoded too. Comparing a decoded path against an
+        // encoded prefix would never match and would wrongly make every
+        // protected page public. Decode both sides so the comparison matches
+        // what routing actually serves.
+        fn decode(s: &str) -> std::borrow::Cow<'_, str> {
+            percent_encoding::percent_decode_str(s).decode_utf8_lossy()
+        }
+        let decoded = decode(path);
         let path = decoded.as_ref();
-        !self.protected_paths.iter().any(|p| path.starts_with(p))
-            || self.public_paths.iter().any(|p| path.starts_with(p))
+        !self
+            .protected_paths
+            .iter()
+            .any(|p| path.starts_with(decode(p).as_ref()))
+            || self
+                .public_paths
+                .iter()
+                .any(|p| path.starts_with(decode(p).as_ref()))
     }
 
     /// Creates a custom ID token verifier that supports multiple issuers
@@ -1308,6 +1321,43 @@ mod tests {
         );
     }
 
+    #[test]
+    fn encoded_site_prefix_keeps_protected_paths_protected() {
+        // When site_prefix contains a percent-encoded character (e.g. a space),
+        // the configured prefixes are stored encoded, e.g. "/my%20app/protected".
+        // The request path is percent-decoded before matching, so the prefixes
+        // must be decoded the same way; otherwise nothing matches and protected
+        // pages become public.
+        let config = test_oidc_config_with_paths(vec!["/my%20app/protected".to_string()], vec![]);
+
+        assert!(
+            !config.is_public_path("/my%20app/protected/page.sql"),
+            "protected page under an encoded site_prefix must not be public"
+        );
+        // The encoded-byte bypass must still be blocked here too.
+        assert!(
+            !config.is_public_path("/my%20app/%70rotected/"),
+            "/my%20app/%70rotected/ decodes to the protected path"
+        );
+        // A non-protected page under the same site_prefix stays public.
+        assert!(
+            config.is_public_path("/my%20app/login.sql"),
+            "non-protected page should remain public"
+        );
+    }
+
+    #[test]
+    fn encoded_site_prefix_default_protected_root_protects_everything() {
+        // Default oidc_protected_paths ["/"] under an encoded site_prefix becomes
+        // ["/my%20app/"]. Every page under the prefix must stay protected.
+        let config = test_oidc_config_with_paths(vec!["/my%20app/".to_string()], vec![]);
+
+        assert!(
+            !config.is_public_path("/my%20app/anything.sql"),
+            "with a protected root, every page under the site_prefix must be protected"
+        );
+    }
+
     #[test]
     fn evicts_excess_tmp_login_flow_state_cookies() {
         let request = (0..MAX_OIDC_PARALLEL_LOGIN_FLOWS)