Fix SSO popup callback infinite loop and post-login 500.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Auth/SsoLoginController.php

@@ -83,6 +83,8 @@ class SsoLoginController extends Controller
     {
         $intended = (string) $request->session()->get('sso.intended', route('transfer.dashboard'));
 
+        $popup = (bool) $request->session()->get('sso.popup');
+
         if ($request->filled('error')) {
             if (in_array($request->query('error'), ['login_required', 'interaction_required', 'consent_required'], true)
                 && ! $request->boolean('interactive')) {
@@ -92,12 +94,12 @@ class SsoLoginController extends Controller
                 ]);
             }
 
-            return $this->finishCallback($request, $intended, (string) $request->query('error_description', $request->query('error')));
+            return $this->finishCallback($request, $intended, (string) $request->query('error_description', $request->query('error')), $popup);
         }
 
         if (! $request->filled('code')
             || $request->query('state') !== $request->session()->pull('sso.state')) {
-            return $this->finishCallback($request, $intended, 'invalid_state');
+            return $this->finishCallback($request, $intended, 'invalid_state', $popup);
         }
 
         $issuer = rtrim((string) config('services.ladill_sso.issuer'), '/');
@@ -111,12 +113,12 @@ class SsoLoginController extends Controller
             'code_verifier' => (string) $request->session()->pull('sso.verifier'),
         ]);
         if ($tokenRes->failed()) {
-            return $this->finishCallback($request, $intended, 'token_exchange_failed');
+            return $this->finishCallback($request, $intended, 'token_exchange_failed', $popup);
         }
 
         $user = $this->loginFromTokenResponse($request, $tokenRes);
         if (! $user) {
-            return $this->finishCallback($request, $intended, 'userinfo_failed');
+            return $this->finishCallback($request, $intended, 'userinfo_failed', $popup);
         }
 
         QrTeamMember::linkPendingInvitesFor($user);
@@ -124,7 +126,7 @@ class SsoLoginController extends Controller
         Auth::login($user, remember: true);
         $request->session()->regenerate();
 
-        return $this->finishCallback($request, $intended);
+        return $this->finishCallback($request, $intended, null, $popup);
     }
 
     public function logout(Request $request): RedirectResponse
@@ -248,13 +250,18 @@ class SsoLoginController extends Controller
         return strtolower((string) $user->email) !== $mailbox;
     }
 
-    private function finishCallback(Request $request, string $intended, ?string $error = null): RedirectResponse|View
+    private function finishCallback(Request $request, string $intended, ?string $error = null, bool $popup = false): RedirectResponse|View
     {
-        if ($request->session()->pull('sso.popup')) {
+        if ($popup) {
             return view('auth.sso-popup-done', [
                 'intended' => $intended,
                 'error' => $error,
                 'appOrigin' => rtrim((string) config('app.url'), '/'),
+                'fallbackUrl' => route('sso.connect', [
+                    'redirect' => $intended,
+                    'interactive' => 1,
+                    'fallback' => 1,
+                ]),
             ]);
         }