show sso page in browser for gateway resource

src/app/[orgId]/resource/[resourceGuid]/keys/page.tsx

@@ -18,7 +18,7 @@ import { cache } from "react";
 export async function generateMetadata(): Promise<Metadata> {
     const t = await getTranslations();
     return {
-        title: t("myVirtualApiKeysResourceTitle")
+        title: t("myVirtualApiKeysTitle")
     };
 }
 
@@ -42,7 +42,7 @@ export default async function ResourceKeysPage(props: ResourceKeysPageProps) {
 
     if (!user) {
         redirect(
-            `/auth/login?redirect=/${orgId}/resource/${resourceGuid}/keys`
+            `/auth/resource/${encodeURIComponent(resourceGuid)}?redirect=${encodeURIComponent(`/${orgId}/resource/${resourceGuid}/keys`)}`
         );
     }
 
@@ -113,11 +113,7 @@ export default async function ResourceKeysPage(props: ResourceKeysPageProps) {
                 launcherMode
                 showViewAsAdmin={isAdminOrOwner}
             >
-                <UserVirtualApiKeys
-                    orgId={orgId}
-                    resourceGuid={resourceGuid}
-                    initialData={keysData}
-                />
+                <UserVirtualApiKeys orgId={orgId} initialData={keysData} />
             </Layout>
         </UserProvider>
     );

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -163,17 +163,11 @@ export default async function ResourceAuthPage(props: {
     if (user && !user.emailVerified && env.flags.emailVerificationRequired) {
         redirect(
             `/auth/verify-email?redirect=${encodeURIComponent(
-                isInference
-                    ? keysPath
-                    : `/auth/resource/${authInfo.resourceGuid}`
+                `/auth/resource/${authInfo.resourceGuid}`
             )}`
         );
     }
 
-    if (isInference && !user) {
-        redirect(`/auth/login?redirect=${encodeURIComponent(keysPath)}`);
-    }
-
     const cookie = await authCookieHeader();
 
     // Check org policy compliance before proceeding
@@ -192,9 +186,7 @@ export default async function ResourceAuthPage(props: {
 
     // If user is not compliant with org policies, show policy requirements
     if (orgPolicyCheck && !orgPolicyCheck.allowed && orgPolicyCheck.policies) {
-        const resourceAuthPageUrl = isInference
-            ? keysPath
-            : `/auth/resource/${authInfo.resourceGuid}${redirectUrl !== authInfo.url ? `?redirect=${encodeURIComponent(redirectUrl)}` : ""}`;
+        const resourceAuthPageUrl = `/auth/resource/${authInfo.resourceGuid}${redirectUrl !== authInfo.url ? `?redirect=${encodeURIComponent(redirectUrl)}` : ""}`;
         return (
             <div className="w-full max-w-md">
                 <OrgPolicyRequired
@@ -208,10 +200,14 @@ export default async function ResourceAuthPage(props: {
 
     // Inference resources never establish a resource session on the inference
     // host. Authenticated users retrieve their virtual API key on the dashboard.
-    if (isInference) {
+    if (isInference && user) {
         redirect(keysPath);
     }
 
+    // After password/pincode/SSO, do not send the browser back to the
+    // inference host (session alone cannot pass Badger). Land on keys instead.
+    const postAuthRedirect = isInference ? keysPath : redirectUrl;
+
     if (!hasAuth) {
         // no authentication so always go straight to the resource
         redirect(redirectUrl);
@@ -296,7 +292,7 @@ export default async function ResourceAuthPage(props: {
                 <AutoLoginHandler
                     resourceId={authInfo.resourceId}
                     skipToIdpId={authInfo.skipToIdpId}
-                    redirectUrl={redirectUrl}
+                    redirectUrl={postAuthRedirect}
                     orgId={build === "saas" ? authInfo.orgId : undefined}
                 />
             );
@@ -334,7 +330,7 @@ export default async function ResourceAuthPage(props: {
                             name: authInfo.resourceName,
                             id: authInfo.resourceId
                         }}
-                        redirect={redirectUrl}
+                        redirect={postAuthRedirect}
                         idps={loginIdps}
                         orgId={build === "saas" ? authInfo.orgId : undefined}
                         branding={