fix: honor SAML RelayState to redirect to deep link after SSO login (#9225)

* fix: honor SAML RelayState to redirect to deep link after SSO login

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: bump ee-repo-ref for SAML RelayState validator test

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206

This commit updates the EE repository reference after PR #577 was merged in windmill-ee-private.

Previous ee-repo-ref: 445a22536b1a6c342cde0baa6fbca9e25092f94b

New ee-repo-ref: a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-19a76a09ffb43649ee19e62d07e8b8a42d78757b
+a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206

frontend/src/lib/components/Login.svelte

@@ -415,7 +415,21 @@
 			return false
 		}
 		persistRd()
-		window.location.href = saml
+		let target = saml
+		// Carry the SP-initiated deep link through the IdP round-trip via SAML
+		// RelayState so the ACS redirects straight back to it (bypassing
+		// /user/login). Only same-origin relative paths are passed; the backend
+		// re-validates. Absolute `rd` still relies on the localStorage fallback.
+		if (rd && rd.startsWith('/') && !rd.startsWith('//')) {
+			try {
+				const url = new URL(saml)
+				url.searchParams.set('RelayState', rd)
+				target = url.toString()
+			} catch (e) {
+				console.error('Could not set SAML RelayState', e)
+			}
+		}
+		window.location.href = target
 		return true
 	}