From bb26a9f583eb20fca0feaadc8a3a82e48a188a9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Mon, 16 Feb 2026 17:18:58 +0100
Subject: [PATCH] improve devkey test for oauth

---
 docker-compose.yml                            |  1 +
 .../Projects/ProjectsConsoleClientTest.php    | 31 ++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index ab33920060..635b1cb2cf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -738,6 +738,7 @@ services:
     depends_on:
       - redis
       - maildev
+      - ${_APP_DB_HOST:-mariadb}
       # - smtp
     environment:
       - _APP_ENV
diff --git a/tests/e2e/Services/Projects/ProjectsConsoleClientTest.php b/tests/e2e/Services/Projects/ProjectsConsoleClientTest.php
index 64556522f5..4eccad4966 100644
--- a/tests/e2e/Services/Projects/ProjectsConsoleClientTest.php
+++ b/tests/e2e/Services/Projects/ProjectsConsoleClientTest.php
@@ -5376,7 +5376,7 @@ class ProjectsConsoleClientTest extends Scope
         ]);
         $this->assertEquals(400, $response['headers']['status-code']);
 
-        /** Test oauth2 with devKey and now get oauth2 is disabled */
+        /** Test oauth2 with devKey and now flow works with untrusted URL too */
         $response = $this->client->call(Client::METHOD_GET, '/account/sessions/oauth2/' . $provider, [
             'content-type' => 'application/json',
             'x-appwrite-project' => $projectId,
@@ -5385,7 +5385,36 @@ class ProjectsConsoleClientTest extends Scope
             'success' => 'https://example.com',
             'failure' => 'https://example.com'
         ], followRedirects: false);
+
         $this->assertEquals(301, $response['headers']['status-code']);
+        $this->assertArrayHasKey('location', $response['headers']);
+
+        $location = $response['headers']['location'];
+
+
+        $locationClient = new Client();
+        $locationClient->setEndpoint('');
+        $locationClient->addHeader('x-appwrite-dev-key', $devKey['secret']);
+
+        $response = $locationClient->call(Client::METHOD_GET, $location, followRedirects: false);
+
+        $this->assertEquals(301, $response['headers']['status-code']);
+        $this->assertArrayHasKey('location', $response['headers']);
+
+        $location = $response['headers']['location'];
+        $this->assertStringStartsWith('http://appwrite:/v1/account/sessions/oauth2/callback/mock/', $response['headers']['location']);
+
+        $response = $locationClient->call(Client::METHOD_GET, $location, followRedirects: false);
+        $this->assertEquals(301, $response['headers']['status-code']);
+        $this->assertArrayHasKey('location', $response['headers']);
+
+        $location = $response['headers']['location'];
+        $this->assertStringStartsWith('http://appwrite:/v1/account/sessions/oauth2/mock/redirect', $response['headers']['location']);
+
+        $response = $locationClient->call(Client::METHOD_GET, $location, followRedirects: false);
+
+        $this->assertEquals(301, $response['headers']['status-code']);
+        $this->assertSame('https://example.com/#', $response['headers']['location']);
 
         /** Ensure any hostname is allowed */
         $response = $this->client->call(Client::METHOD_GET, '/account/sessions/oauth2/' . $provider, [