fix: correct OAuth authorization URL construction

Author: aktech

pkg/auth/oauth.go

@@ -59,14 +59,22 @@ func NewOAuthMiddlewareWithCallbackPath(log *logger.Logger, callbackPath string)
 	}
 
 	hubHost := os.Getenv("JUPYTERHUB_HOST")
-	hubPrefix := os.Getenv("JUPYTERHUB_BASE_URL")
-	if hubPrefix == "" {
-		hubPrefix = "/hub/"
+
+	// JUPYTERHUB_BASE_URL is the base URL of the deployment (e.g., "/" or "/jupyter/")
+	// NOT the Hub's base URL. JupyterHub strips "/hub" from the Hub's base_url
+	// when setting this env var. We need to append "hub/" to get the Hub's base path,
+	// just like JupyterHub's HubOAuth class does.
+	deploymentBase := os.Getenv("JUPYTERHUB_BASE_URL")
+	if deploymentBase == "" {
+		deploymentBase = "/"
 	}
-	if !strings.HasSuffix(hubPrefix, "/") {
-		hubPrefix += "/"
+	if !strings.HasSuffix(deploymentBase, "/") {
+		deploymentBase += "/"
 	}
 
+	// Construct the Hub's base path by appending "hub/" to the deployment base
+	hubPrefix := deploymentBase + "hub/"
+
 	return &OAuthMiddleware{
 		clientID:     clientID,
 		apiToken:     apiToken,

test/integration/oauth_callback_test.go

@@ -49,11 +49,13 @@ func TestOAuthCallbackForInterimPages(t *testing.T) {
 	)
 
 	// Set JupyterHub environment variables pointing to mock server
+	// Note: JUPYTERHUB_BASE_URL is the deployment base, NOT the Hub's base.
+	// JupyterHub strips "/hub" from hub.base_url when setting this env var.
 	cmd.Env = append(os.Environ(),
 		"JUPYTERHUB_API_TOKEN=test-token-12345",
 		"JUPYTERHUB_API_URL="+hubURL+"/hub/api",
 		"JUPYTERHUB_HOST="+hubURL,
-		"JUPYTERHUB_BASE_URL=/hub/",
+		"JUPYTERHUB_BASE_URL=/",
 		"JUPYTERHUB_USER=testuser",
 		"JUPYTERHUB_SERVICE_PREFIX=/user/testuser/",
 		"JUPYTERHUB_CLIENT_ID=jupyterhub-user-testuser",