fix: preserve next redirect across OAuth session cleanup

CHANGELOG.rst

@@ -12,6 +12,12 @@ Change Log
 Unreleased
 ----------
 
+Fixed
+~~~~~
+
+* Session cleanup in ``EdXOAuth2.start()`` no longer discards the ``next`` redirect that social-auth stores before the OAuth flow begins. Users who were already logged in were sent to ``LOGIN_REDIRECT_URL`` instead of the page they asked for.
+* The same cleanup also keeps any fields listed in ``FIELDS_STORED_IN_SESSION``, which social-auth stores at the same point.
+
 
 [4.6.2] - 2025-10-16
 --------------------

src/auth_backends/backends.py

@@ -98,7 +98,17 @@ def start(self):
                 existing_username
             )
 
+            # logout() flushes the session, which also holds what social-auth just stored for this request:
+            # the sanitized redirect and any FIELDS_STORED_IN_SESSION. Carry only those across.
+            stored_names = [*self.setting('FIELDS_STORED_IN_SESSION', [])]
+            # do_auth() only writes `next` when this request carries one, otherwise the value is left over
+            # from an earlier login and should not survive the logout.
+            if 'next' in self.strategy.request_data(merge=False):
+                stored_names.append('next')
+            stored_values = {name: self.strategy.session_get(name) for name in stored_names}
             logout(request)
+            for name, value in stored_values.items():
+                self.strategy.session_set(name, value)
 
         return super().start()
 

src/auth_backends/tests/test_backends.py

@@ -159,6 +159,33 @@ def test_start_with_session_cleanup(self, user_authenticated, mock_logger, mock_
         else:
             mock_logger.info.assert_not_called()
 
+    @pytest.mark.django_db
+    @ddt.data(True, False)  # request with `next`, and without (session holds a leftover from an earlier login)
+    @patch('auth_backends.backends.set_custom_attribute')
+    @patch('auth_backends.backends.logger')
+    def test_start_with_session_cleanup_preserves_next(self, request_has_next, _mock_logger, _mock_set_attr):
+        """Only the redirect this request asked for survives the session cleanup; a leftover one does not."""
+        request = RequestFactory().get('/auth/login/edx-oauth2/?next=/credentials/abc/')
+        request.user = User.objects.create_user(username='existing_user', email='existing@example.com')
+        middleware = SessionMiddleware(lambda req: None)
+        middleware.process_request(request)
+        request.session.save()
+        self.backend.strategy.request = request
+        # In production the strategy's session IS request.session; the fake test strategy keeps its own dict.
+        self.backend.strategy._session = request.session  # pylint: disable=protected-access
+        self.set_social_auth_setting('FIELDS_STORED_IN_SESSION', ['auth_entry'])
+        if request_has_next:
+            self.backend.strategy.set_request_data({'next': '/credentials/abc/'}, self.backend)
+        self.backend.strategy.session_set('next', '/credentials/abc/')
+        self.backend.strategy.session_set('auth_entry', 'login')
+
+        self.do_start()
+
+        self.assertTrue(request.user.is_anonymous)
+        expected_next = '/credentials/abc/' if request_has_next else None
+        self.assertEqual(self.backend.strategy.session_get('next'), expected_next)
+        self.assertEqual(self.backend.strategy.session_get('auth_entry'), 'login')
+
     def test_partial_pipeline(self):
         self.do_partial_pipeline()