Respect "start_url" from manifest when launching web apps

app/models/remote_storage_authorization.rb

@@ -23,11 +23,23 @@ class RemoteStorageAuthorization < ApplicationRecord
   after_destroy  :remove_token_expiry_job
 
   def url
-    # TODO use web app scope in addition to host/client_id
     uri = URI.parse self.redirect_uri
     "#{uri.scheme}://#{client_id}"
   end
 
+  def launch_url
+    return url unless web_app && web_app.metadata[:start_url].present?
+
+    start_url = web_app.metadata[:start_url]
+
+    if start_url.match("^https?:\/\/")
+      return start_url.start_with?(url) ? start_url : url
+    else
+      path = start_url.gsub(/^\.\.\//, "").gsub(/^\.\//, "").gsub(/^\//, "")
+      "#{url}/#{path}"
+    end
+  end
+
   def delete_token_from_redis
     key = "authorizations:#{user.cn}:#{token}"
     redis.srem? key, redis.smembers(key)