fix: implement CodeRabbit suggestions

- Gate cancellation UX with use_redirect_auth, not return_url.
- Add a popup-mode regression test when return_url is present.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>

Author: thepatrickchin

packages/nvidia_nat_core/src/nat/front_ends/fastapi/routes/auth.py

@@ -62,7 +62,7 @@ async def redirect_uri(request: Request):
                 if not flow_state.future.done():
                     flow_state.future.set_exception(
                         RuntimeError(f"Authorisation denied: {error} ({error_description})"))
-                if flow_state.return_url:
+                if flow_state.config and flow_state.config.use_redirect_auth:
                     return HTMLResponse(content=build_auth_redirect_cancelled_html(flow_state.return_url),
                                         status_code=200,
                                         headers={

packages/nvidia_nat_core/tests/nat/front_ends/auth_flow_handlers/test_websocket_flow_handler.py

@@ -174,7 +174,7 @@ async def create_websocket_message(self, msg):
     token_val = ctx.headers["Authorization"].split()[1]
     assert token_val in mock_server.tokens, "token not issued by mock server"
 
-    # all flow‑state cleaned up
+    # all flow-state cleaned up
     assert worker._outstanding_flows == {}
 
 

packages/nvidia_nat_core/tests/nat/front_ends/fastapi/test_auth_redirect_route.py

@@ -84,6 +84,18 @@ async def test_access_denied_popup_returns_cancelled_html():
     assert "AUTH_ERROR" not in response.text
 
 
+async def test_access_denied_popup_with_return_url_still_returns_cancelled_html():
+    """error=access_denied in popup mode uses popup HTML even when return_url is set."""
+    flow_state = FlowState(config=_POPUP_CONFIG, return_url=_RETURN_URL)
+    worker = _make_worker(flow_state)
+    response = await _get(worker, {"state": "teststate", "error": "access_denied"})
+    assert response.status_code == 200
+    assert "AUTH_CANCELLED" in response.text
+    assert "AUTH_ERROR" not in response.text
+    assert _RETURN_URL.replace("/", "\\u002f") not in response.text
+    assert "oauth_auth_completed" not in response.text
+
+
 async def test_access_denied_redirect_returns_cancelled_html():
     """error=access_denied in redirect mode returns the redirect-back cancelled page."""
     flow_state = FlowState(config=_REDIRECT_CONFIG, return_url=_RETURN_URL)