# frozen_string_literal: true

module Spree
  module Admin
    class PostageLabelsController < Spree::Admin::BaseController
      def show
        @shipment = Spree::Shipment.find_by(number: params[:shipment_id])
        authorize! @shipment, :show

        unless @shipment.easypost_postage_label_url
          flash[:error] = t('.no_postage_label', shipment_number: @shipment.number)
          redirect_back(fallback_location: edit_admin_order_path(@shipment.order))
          return
        end

        redirect_to @shipment.easypost_postage_label_url
      end
    end
  end
end

# frozen_string_literal: true

module Spree
  module Admin
    class PostageLabelsController < Spree::Admin::BaseController
      def show
        @shipment = Spree::Shipment.find_by(number: params[:shipment_id])
        authorize! @shipment, :show

        unless @shipment.easypost_postage_label_url
          flash[:error] = t('.no_postage_label', shipment_number: @shipment.number)
          redirect_back(fallback_location: edit_admin_order_path(@shipment.order))
          return
        end

        redirect_to @shipment.easypost_postage_label_url, allow_other_host: true
      end
    end
  end
end

Fix redirect when Rails' `raise_on_open_redirect` is true
Fix redirect when Rails' `raise_on_open_redirect` is true

That is the new default on Rails 7. We need to be explicit to allow
redirecting to an external host.

See https://api.rubyonrails.org/classes/ActionController/Redirecting.html#method-i-redirect_to-label-Open+Redirect+protection
