ensure redirect to index if no justice id regardless of route hit

controlpanel/oidc.py

@@ -65,13 +65,22 @@ def verify_claims(self, claims):
 
 
 class StateMismatchHandler(OIDCAuthenticationCallbackView):
+
     def get(self, *args, **kwargs):
         try:
             return super().get(*args, **kwargs)
         except SuspiciousOperation as e:
             log.warning(f"Caught {e}: redirecting to login")
             return HttpResponseRedirect(settings.LOGIN_REDIRECT_URL_FAILURE)
 
+    @property
+    def success_url(self):
+
+        if not self.user.justice_email:
+            return reverse("index")
+
+        return super().success_url
+
 
 def logout(request):
     params = urlencode(

tests/test_oidc.py

@@ -0,0 +1,21 @@
+import pytest
+from controlpanel.oidc import StateMismatchHandler
+from unittest.mock import Mock
+
+
+@pytest.mark.parametrize(
+    "email, success_url",
+    [
+        ("", "/"),
+        ("[email protected]", "/tools/"),
+    ],
+)
+def test_success_url(users, email, success_url):
+    request = Mock()
+    request.session.get.return_value = "/tools/"
+    user = users["normal_user"]
+    user.justice_email = email
+    view = StateMismatchHandler()
+    view.request = request
+    view.user = user
+    assert view.success_url == success_url