get-a-token-missing-auth-code-fix - Redirect direct getAToken visits without auth code to sign-in

[Chad Palmer (chadpalmer)]

Summary

• Redirects browser requests to /getAToken without an OAuth authorization code back to the SimpleChat home/sign-in page.
• Preserves the normal Microsoft Entra authorization-code callback flow.
• Leaves /getATokenApi explicit error behavior unchanged for API token callback callers.
• Adds functional regression coverage and fix documentation.
• Updates version/release notes for 0.250.129.

Validation

• git diff --check upstream/Development...HEAD
• python -m py_compile application/single_app/config.py application/single_app/route_frontend_authentication.py functional_tests/test_getatoken_missing_code_redirect.py
• python scripts/check_swagger_routes.py application/single_app/route_frontend_authentication.py
• python functional_tests/route_tests/test_route_blueprint_policy_inventory.py
• python functional_tests/route_tests/test_route_unauthenticated_policy_contract.py
• python functional_tests/route_tests/test_route_policy_test_coverage.py
• python scripts/check_xss_sinks.py --full-file application/single_app/config.py application/single_app/route_frontend_authentication.py
• python scripts/check_broken_access_control.py --full-file application/single_app/config.py application/single_app/route_frontend_authentication.py
• python functional_tests/test_getatoken_missing_code_redirect.py

Notes

• Branch is up to date with upstream/Development.
• No secrets, .env files, generated local artifacts, or session files are included in the changed-file set.
• Version: 0.250.129
• Release notes updated.

[Chad Palmer (chadpalmer)]

Bionic711 Paul Lizer (@paullizer) This quick fix redirects a user to the sign in/index page when they hit the getAToken url without being signed in. This happens when a user goes to a app section directly such as /my_groups without signing in first. (Likely due to browser auto-completing url)