From 34e10f59724472e827d59cd2ee6a34efcca8d798 Mon Sep 17 00:00:00 2001
From: Martyn Gigg <martyn.gigg@gmail.com>
Date: Tue, 12 Aug 2025 22:26:04 +0100
Subject: [PATCH] fix(superset-ui-core): Include appRoot in endpoint of
 SupersetClientClass.postForm action (#34395)

---
 .../cypress/e2e/auth/login.test.ts            |  2 +-
 .../src/connection/SupersetClientClass.ts     | 10 +++--
 .../connection/SupersetClientClass.test.ts    | 40 ++++++++++++-------
 3 files changed, 33 insertions(+), 19 deletions(-)

diff --git a/superset-frontend/cypress-base/cypress/e2e/auth/login.test.ts b/superset-frontend/cypress-base/cypress/e2e/auth/login.test.ts
index c3ab251632f..064167d82d9 100644
--- a/superset-frontend/cypress-base/cypress/e2e/auth/login.test.ts
+++ b/superset-frontend/cypress-base/cypress/e2e/auth/login.test.ts
@@ -19,7 +19,7 @@
 import { LOGIN } from 'cypress/utils/urls';
 
 function interceptLogin() {
-  cy.intercept('POST', '/login/').as('login');
+  cy.intercept('POST', '**/login/').as('login');
 }
 
 describe('Login view', () => {
diff --git a/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts b/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
index 92f2e50198f..4b826fd27bf 100644
--- a/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
+++ b/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
@@ -115,11 +115,15 @@ export default class SupersetClientClass {
     return this.getCSRFToken();
   }
 
-  async postForm(url: string, payload: Record<string, any>, target = '_blank') {
-    if (url) {
+  async postForm(
+    endpoint: string,
+    payload: Record<string, any>,
+    target = '_blank',
+  ) {
+    if (endpoint) {
       await this.ensureAuth();
       const hiddenForm = document.createElement('form');
-      hiddenForm.action = url;
+      hiddenForm.action = this.getUrl({ endpoint });
       hiddenForm.method = 'POST';
       hiddenForm.target = target;
       const payloadWithToken: Record<string, any> = {
diff --git a/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts b/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
index f7534e2c5c3..6a778cdd35d 100644
--- a/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
+++ b/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
@@ -658,26 +658,36 @@ describe('SupersetClientClass', () => {
       jest.restoreAllMocks();
     });
 
-    it('makes postForm request', async () => {
-      await client.postForm(mockPostFormUrl, {});
+    it.each(['', '/prefix'])(
+      "makes postForm request when appRoot is '%s'",
+      async appRoot => {
+        if (appRoot !== '') {
+          client = new SupersetClientClass({ protocol, host, appRoot });
+          authSpy = jest.spyOn(SupersetClientClass.prototype, 'ensureAuth');
+          await client.init();
+        }
+        await client.postForm(mockPostFormEndpoint, {});
 
-      const hiddenForm = createElement.mock.results[0].value;
-      const csrfTokenInput = createElement.mock.results[1].value;
+        const hiddenForm = createElement.mock.results[0].value;
+        const csrfTokenInput = createElement.mock.results[1].value;
 
-      expect(createElement.mock.calls).toHaveLength(2);
+        expect(createElement.mock.calls).toHaveLength(2);
 
-      expect(hiddenForm.action).toBe(mockPostFormUrl);
-      expect(hiddenForm.method).toBe('POST');
-      expect(hiddenForm.target).toBe('_blank');
+        expect(hiddenForm.action).toBe(
+          `${protocol}//${host}${appRoot}${mockPostFormEndpoint}`,
+        );
+        expect(hiddenForm.method).toBe('POST');
+        expect(hiddenForm.target).toBe('_blank');
 
-      expect(csrfTokenInput.type).toBe('hidden');
-      expect(csrfTokenInput.name).toBe('csrf_token');
-      expect(csrfTokenInput.value).toBe(1234);
+        expect(csrfTokenInput.type).toBe('hidden');
+        expect(csrfTokenInput.name).toBe('csrf_token');
+        expect(csrfTokenInput.value).toBe(1234);
 
-      expect(appendChild.mock.calls).toHaveLength(1);
-      expect(removeChild.mock.calls).toHaveLength(1);
-      expect(authSpy).toHaveBeenCalledTimes(1);
-    });
+        expect(appendChild.mock.calls).toHaveLength(1);
+        expect(removeChild.mock.calls).toHaveLength(1);
+        expect(authSpy).toHaveBeenCalledTimes(1);
+      },
+    );
 
     it('makes postForm request with guest token', async () => {
       client = new SupersetClientClass({ protocol, host, guestToken });