@aglyn/shared-util-next 1.0.0-beta.143

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,3 @@
+# shared-util-next
+
+This library was generated with [Nx](https://nx.dev).

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@aglyn/shared-util-next",
+  "version": "1.0.0-beta.143",
+  "license": "Apache-2.0",
+  "homepage": "https://aglyn.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aglyn/aglyn.git",
+    "directory": "libs/shared/util/next"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./*": {
+      "types": "./src/lib/*.d.ts",
+      "default": "./src/lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@aglyn/shared-util-http": "1.0.0-beta.143",
+    "@swc/helpers": "0.5.23"
+  },
+  "peerDependencies": {
+    "next": "16.3.3",
+    "react": "^19.2.8"
+  },
+  "sideEffects": false,
+  "types": "./src/index.d.ts",
+  "module": "./src/index.js",
+  "type": "module",
+  "main": "./src/index.js"
+}

package/src/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './lib/use-continue-url';

package/src/index.js

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export * from "./lib/use-continue-url.js";
+
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/shared/util/next/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/use-continue-url'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,4BAAwB"}

package/src/lib/use-continue-url.d.ts

@@ -0,0 +1,72 @@
+export type UseContinueUrlDecodedRoutePusher = (url?: string, as?: string, options?: {
+    shallow?: boolean;
+    locale?: string | false;
+    scroll?: boolean;
+}) => void;
+export type UseContinueUrlDecodedResponse = [
+    decoded: string,
+    pushNext: UseContinueUrlDecodedRoutePusher
+];
+export type UseContinueUrlResponse = [
+    encoded: string,
+    decoded: string,
+    pushNext: UseContinueUrlDecodedRoutePusher
+];
+export declare const ContinueParamName = "continue";
+export declare const continueParam: (value: string) => string;
+/**
+ * Only same-app relative paths, or same-site absolute URLs within the
+ * workspace domain (AGL-465), may be continued to — anything else absolute
+ * or protocol-relative would make the post-auth redirect an open redirect.
+ *
+ * The relative branch defers to {@link isSameOriginPath} rather than testing
+ * the string's shape (AGL-1881). AGL-2486 rejected `\` here because the
+ * WHATWG URL parser treats it as `/` in the authority position, so
+ * `/\evil.com` passed a `startsWith('/') && !startsWith('//')` test and still
+ * resolved off-site. That was true but incomplete: the same parser also
+ * DELETES every tab, LF and CR before parsing, so `/<TAB>/evil.com` resolves
+ * to `https://evil.com/` while containing neither `//` nor `\`. Enumerating
+ * the tricks was the mistake; the shared predicate resolves the value and
+ * compares origins, which is the question `window.location.assign` will
+ * actually ask.
+ *
+ * The absolute branch below never had that bug and keeps its own check: once
+ * the input is absolute the parser's `hostname` is already ground truth.
+ *
+ * A `continue` that has survived an external IdP round trip is the case that
+ * makes this matter: whatever we put into `state` comes back as untrusted
+ * input.
+ *
+ * `''` is rejected explicitly rather than by accident. `strictNullChecks` is
+ * off repo-wide, so an absent param arrives here as an empty string far more
+ * often than as `undefined`, and "no continue" must read as unsafe so the
+ * caller falls back to its own default instead of building `?continue=`.
+ */
+export declare const isSafeContinueUrl: (url: string) => boolean;
+/**
+ * Forward the continue URL onto another same-app path (AGL-2486).
+ *
+ * A signed-out user who deep-links in arrives at `/signin?continue=…`, and
+ * every link OUT of that page to another auth route — the SSO button above
+ * all — has to carry the value or the destination they were going to is
+ * gone. Observed on the SSO button: the url does not carry the
+ * continue url and is dropped entirely.
+ *
+ * Unsafe or absent values append nothing, so a poisoned `continue` degrades
+ * to a plain link rather than being laundered one hop further along.
+ */
+export declare function withContinueUrl(path: string, continueUrl: string): string;
+/**
+ * `href` for a link out of the current page that keeps the continue URL.
+ *
+ * Deliberately reads `useSearchParams` directly instead of reusing
+ * {@link useContinueUrlDecoded}: that hook also calls `useRouter`, and a
+ * link does not navigate imperatively. Pulling the router in would make
+ * every page that renders one of these links require an App Router context
+ * it does not otherwise need.
+ */
+export declare function useContinueHref(path: string): string;
+export declare function useContinueUrlDecoded(): UseContinueUrlDecodedResponse;
+export declare function useContinueUrlEncoded(): string;
+export declare function useContinueUrl(): UseContinueUrlResponse;
+export default useContinueUrl;

package/src/lib/use-continue-url.js

@@ -0,0 +1,165 @@
+var _process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN;
+/**
+ * @license
+ * Copyright 2024 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { isSameOriginPath } from "@aglyn/shared-util-http/safe-redirect";
+import { usePathname, useRouter, useSearchParams } from "next/navigation";
+import { useCallback, useMemo } from "react";
+export const ContinueParamName = 'continue';
+export const continueParam = (value)=>`${ContinueParamName}=${value}`;
+const WORKSPACE_DOMAIN = (_process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN = process.env.NEXT_PUBLIC_WORKSPACE_DOMAIN) != null ? _process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN : 'aglyn.com';
+/**
+ * Same-site absolute returns (AGL-465): the auth host signs a user in and
+ * must redirect back to the {org}.<workspaceDomain> subdomain they started
+ * from, which is a cross-origin URL. Allow it only when the host is within
+ * the workspace domain over https, so this stays first-party and never
+ * becomes an open redirect.
+ */ const isSameSiteAbsoluteUrl = (url)=>{
+    try {
+        const { protocol, hostname } = new URL(url);
+        if (protocol !== 'https:') return false;
+        return hostname === WORKSPACE_DOMAIN || hostname.endsWith(`.${WORKSPACE_DOMAIN}`);
+    } catch (unused) {
+        return false;
+    }
+};
+/**
+ * Only same-app relative paths, or same-site absolute URLs within the
+ * workspace domain (AGL-465), may be continued to — anything else absolute
+ * or protocol-relative would make the post-auth redirect an open redirect.
+ *
+ * The relative branch defers to {@link isSameOriginPath} rather than testing
+ * the string's shape (AGL-1881). AGL-2486 rejected `\` here because the
+ * WHATWG URL parser treats it as `/` in the authority position, so
+ * `/\evil.com` passed a `startsWith('/') && !startsWith('//')` test and still
+ * resolved off-site. That was true but incomplete: the same parser also
+ * DELETES every tab, LF and CR before parsing, so `/<TAB>/evil.com` resolves
+ * to `https://evil.com/` while containing neither `//` nor `\`. Enumerating
+ * the tricks was the mistake; the shared predicate resolves the value and
+ * compares origins, which is the question `window.location.assign` will
+ * actually ask.
+ *
+ * The absolute branch below never had that bug and keeps its own check: once
+ * the input is absolute the parser's `hostname` is already ground truth.
+ *
+ * A `continue` that has survived an external IdP round trip is the case that
+ * makes this matter: whatever we put into `state` comes back as untrusted
+ * input.
+ *
+ * `''` is rejected explicitly rather than by accident. `strictNullChecks` is
+ * off repo-wide, so an absent param arrives here as an empty string far more
+ * often than as `undefined`, and "no continue" must read as unsafe so the
+ * caller falls back to its own default instead of building `?continue=`.
+ */ export const isSafeContinueUrl = (url)=>{
+    if (!url) return false;
+    return isSameOriginPath(url) || isSameSiteAbsoluteUrl(url);
+};
+/**
+ * Forward the continue URL onto another same-app path (AGL-2486).
+ *
+ * A signed-out user who deep-links in arrives at `/signin?continue=…`, and
+ * every link OUT of that page to another auth route — the SSO button above
+ * all — has to carry the value or the destination they were going to is
+ * gone. Observed on the SSO button: the url does not carry the
+ * continue url and is dropped entirely.
+ *
+ * Unsafe or absent values append nothing, so a poisoned `continue` degrades
+ * to a plain link rather than being laundered one hop further along.
+ */ export function withContinueUrl(path, continueUrl) {
+    if (!isSafeContinueUrl(continueUrl)) return path;
+    const separator = path.includes('?') ? '&' : '?';
+    return `${path}${separator}${continueParam(encodeURIComponent(continueUrl))}`;
+}
+/**
+ * `href` for a link out of the current page that keeps the continue URL.
+ *
+ * Deliberately reads `useSearchParams` directly instead of reusing
+ * {@link useContinueUrlDecoded}: that hook also calls `useRouter`, and a
+ * link does not navigate imperatively. Pulling the router in would make
+ * every page that renders one of these links require an App Router context
+ * it does not otherwise need.
+ */ export function useContinueHref(path) {
+    var _ref;
+    const searchParams = useSearchParams();
+    const raw = (_ref = searchParams == null ? void 0 : searchParams.get(ContinueParamName)) != null ? _ref : '';
+    return useMemo(()=>withContinueUrl(path, raw), [
+        path,
+        raw
+    ]);
+}
+export function useContinueUrlDecoded() {
+    const router = useRouter();
+    // App Router: query strings live in useSearchParams — useParams only
+    // carries dynamic route segments, which is why the continue redirect
+    // silently broke after the pages→app migration (AGL-458). `get` already
+    // percent-decodes, so no second decode (it would corrupt paths that
+    // legitimately contain %-sequences).
+    const searchParams = useSearchParams();
+    const continueUrl = useMemo(()=>{
+        var _ref;
+        const url = (_ref = searchParams == null ? void 0 : searchParams.get(ContinueParamName)) != null ? _ref : '';
+        return isSafeContinueUrl(url) ? url : '';
+    }, [
+        searchParams
+    ]);
+    const pushNext = useCallback((url = '/', as = undefined, options)=>{
+        const target = continueUrl || url;
+        // A same-site absolute return (AGL-465) is cross-origin — the App
+        // Router's client navigation can't cross origins, so hand it to the
+        // browser. Relative paths keep the SPA transition.
+        if (/^https?:\/\//.test(target)) {
+            if (typeof window !== 'undefined') window.location.assign(target);
+            return;
+        }
+        return router.push(target, options);
+    }, [
+        router,
+        continueUrl
+    ]);
+    return useMemo(()=>{
+        return [
+            continueUrl,
+            pushNext
+        ];
+    }, [
+        continueUrl,
+        pushNext
+    ]);
+}
+export function useContinueUrlEncoded() {
+    const pathname = usePathname();
+    return useMemo(()=>{
+        return encodeURIComponent(pathname || '');
+    }, [
+        pathname
+    ]);
+}
+export function useContinueUrl() {
+    const encoded = useContinueUrlEncoded();
+    const [decoded, pushNext] = useContinueUrlDecoded();
+    return useMemo(()=>[
+            encoded,
+            decoded,
+            pushNext
+        ], [
+        encoded,
+        decoded,
+        pushNext
+    ]);
+}
+export default useContinueUrl;
+
+//# sourceMappingURL=use-continue-url.js.map

package/src/lib/use-continue-url.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/shared/util/next/src/lib/use-continue-url.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2024 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { isSameOriginPath } from '@aglyn/shared-util-http/safe-redirect'\nimport { usePathname, useRouter, useSearchParams } from 'next/navigation'\nimport { useCallback, useMemo } from 'react'\n\nexport type UseContinueUrlDecodedRoutePusher = (\n  url?: string,\n  as?: string,\n  options?: { shallow?: boolean; locale?: string | false; scroll?: boolean },\n) => void\n\nexport type UseContinueUrlDecodedResponse = [\n  decoded: string,\n  pushNext: UseContinueUrlDecodedRoutePusher,\n]\n\nexport type UseContinueUrlResponse = [\n  encoded: string,\n  decoded: string,\n  pushNext: UseContinueUrlDecodedRoutePusher,\n]\n\nexport const ContinueParamName = 'continue'\nexport const continueParam = (value: string) => `${ContinueParamName}=${value}`\n\nconst WORKSPACE_DOMAIN =\n  process.env.NEXT_PUBLIC_WORKSPACE_DOMAIN ?? 'aglyn.com'\n\n/**\n * Same-site absolute returns (AGL-465): the auth host signs a user in and\n * must redirect back to the {org}.<workspaceDomain> subdomain they started\n * from, which is a cross-origin URL. Allow it only when the host is within\n * the workspace domain over https, so this stays first-party and never\n * becomes an open redirect.\n */\nconst isSameSiteAbsoluteUrl = (url: string): boolean => {\n  try {\n    const { protocol, hostname } = new URL(url)\n    if (protocol !== 'https:') return false\n    return (\n      hostname === WORKSPACE_DOMAIN ||\n      hostname.endsWith(`.${WORKSPACE_DOMAIN}`)\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Only same-app relative paths, or same-site absolute URLs within the\n * workspace domain (AGL-465), may be continued to — anything else absolute\n * or protocol-relative would make the post-auth redirect an open redirect.\n *\n * The relative branch defers to {@link isSameOriginPath} rather than testing\n * the string's shape (AGL-1881). AGL-2486 rejected `\\` here because the\n * WHATWG URL parser treats it as `/` in the authority position, so\n * `/\\evil.com` passed a `startsWith('/') && !startsWith('//')` test and still\n * resolved off-site. That was true but incomplete: the same parser also\n * DELETES every tab, LF and CR before parsing, so `/<TAB>/evil.com` resolves\n * to `https://evil.com/` while containing neither `//` nor `\\`. Enumerating\n * the tricks was the mistake; the shared predicate resolves the value and\n * compares origins, which is the question `window.location.assign` will\n * actually ask.\n *\n * The absolute branch below never had that bug and keeps its own check: once\n * the input is absolute the parser's `hostname` is already ground truth.\n *\n * A `continue` that has survived an external IdP round trip is the case that\n * makes this matter: whatever we put into `state` comes back as untrusted\n * input.\n *\n * `''` is rejected explicitly rather than by accident. `strictNullChecks` is\n * off repo-wide, so an absent param arrives here as an empty string far more\n * often than as `undefined`, and \"no continue\" must read as unsafe so the\n * caller falls back to its own default instead of building `?continue=`.\n */\nexport const isSafeContinueUrl = (url: string): boolean => {\n  if (!url) return false\n  return isSameOriginPath(url) || isSameSiteAbsoluteUrl(url)\n}\n\n/**\n * Forward the continue URL onto another same-app path (AGL-2486).\n *\n * A signed-out user who deep-links in arrives at `/signin?continue=…`, and\n * every link OUT of that page to another auth route — the SSO button above\n * all — has to carry the value or the destination they were going to is\n * gone. Observed on the SSO button: the url does not carry the\n * continue url and is dropped entirely.\n *\n * Unsafe or absent values append nothing, so a poisoned `continue` degrades\n * to a plain link rather than being laundered one hop further along.\n */\nexport function withContinueUrl(path: string, continueUrl: string): string {\n  if (!isSafeContinueUrl(continueUrl)) return path\n  const separator = path.includes('?') ? '&' : '?'\n  return `${path}${separator}${continueParam(encodeURIComponent(continueUrl))}`\n}\n\n/**\n * `href` for a link out of the current page that keeps the continue URL.\n *\n * Deliberately reads `useSearchParams` directly instead of reusing\n * {@link useContinueUrlDecoded}: that hook also calls `useRouter`, and a\n * link does not navigate imperatively. Pulling the router in would make\n * every page that renders one of these links require an App Router context\n * it does not otherwise need.\n */\nexport function useContinueHref(path: string): string {\n  const searchParams = useSearchParams()\n  const raw = searchParams?.get(ContinueParamName) ?? ''\n  return useMemo(() => withContinueUrl(path, raw), [path, raw])\n}\n\nexport function useContinueUrlDecoded(): UseContinueUrlDecodedResponse {\n  const router = useRouter()\n  // App Router: query strings live in useSearchParams — useParams only\n  // carries dynamic route segments, which is why the continue redirect\n  // silently broke after the pages→app migration (AGL-458). `get` already\n  // percent-decodes, so no second decode (it would corrupt paths that\n  // legitimately contain %-sequences).\n  const searchParams = useSearchParams()\n\n  const continueUrl = useMemo(() => {\n    const url = searchParams?.get(ContinueParamName) ?? ''\n    return isSafeContinueUrl(url) ? url : ''\n  }, [searchParams])\n\n  const pushNext = useCallback(\n    (\n      url = '/',\n      as: string | undefined = undefined,\n      options?: {\n        shallow?: boolean\n        locale?: string | false\n        scroll?: boolean\n      },\n    ): void => {\n      const target = continueUrl || url\n      // A same-site absolute return (AGL-465) is cross-origin — the App\n      // Router's client navigation can't cross origins, so hand it to the\n      // browser. Relative paths keep the SPA transition.\n      if (/^https?:\\/\\//.test(target)) {\n        if (typeof window !== 'undefined') window.location.assign(target)\n        return\n      }\n      return router.push(target, options)\n    },\n    [router, continueUrl],\n  )\n\n  return useMemo(() => {\n    return [continueUrl, pushNext]\n  }, [continueUrl, pushNext])\n}\n\nexport function useContinueUrlEncoded() {\n  const pathname = usePathname()\n\n  return useMemo(() => {\n    return encodeURIComponent(pathname || '')\n  }, [pathname])\n}\n\nexport function useContinueUrl(): UseContinueUrlResponse {\n  const encoded = useContinueUrlEncoded()\n  const [decoded, pushNext] = useContinueUrlDecoded()\n\n  return useMemo(\n    () => [encoded, decoded, pushNext],\n    [encoded, decoded, pushNext],\n  )\n}\n\nexport default useContinueUrl\n"],"names":["process","isSameOriginPath","usePathname","useRouter","useSearchParams","useCallback","useMemo","ContinueParamName","continueParam","value","WORKSPACE_DOMAIN","env","NEXT_PUBLIC_WORKSPACE_DOMAIN","isSameSiteAbsoluteUrl","url","protocol","hostname","URL","endsWith","isSafeContinueUrl","withContinueUrl","path","continueUrl","separator","includes","encodeURIComponent","useContinueHref","searchParams","raw","get","useContinueUrlDecoded","router","pushNext","as","undefined","options","target","test","window","location","assign","push","useContinueUrlEncoded","pathname","useContinueUrl","encoded","decoded"],"mappings":"IA2CEA;AA3CF;;;;;;;;;;;;;;;CAeC,GACD;AAEA,SAASC,gBAAgB,QAAQ,wCAAuC;AACxE,SAASC,WAAW,EAAEC,SAAS,EAAEC,eAAe,QAAQ,kBAAiB;AACzE,SAASC,WAAW,EAAEC,OAAO,QAAQ,QAAO;AAmB5C,OAAO,MAAMC,oBAAoB,WAAU;AAC3C,OAAO,MAAMC,gBAAgB,CAACC,QAAkB,GAAGF,kBAAkB,CAAC,EAAEE,OAAO,CAAA;AAE/E,MAAMC,oBACJV,4CAAAA,QAAQW,GAAG,CAACC,4BAA4B,YAAxCZ,4CAA4C;AAE9C;;;;;;CAMC,GACD,MAAMa,wBAAwB,CAACC;IAC7B,IAAI;QACF,MAAM,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAG,IAAIC,IAAIH;QACvC,IAAIC,aAAa,UAAU,OAAO;QAClC,OACEC,aAAaN,oBACbM,SAASE,QAAQ,CAAC,CAAC,CAAC,EAAER,kBAAkB;IAE5C,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GACD,OAAO,MAAMS,oBAAoB,CAACL;IAChC,IAAI,CAACA,KAAK,OAAO;IACjB,OAAOb,iBAAiBa,QAAQD,sBAAsBC;AACxD,EAAC;AAED;;;;;;;;;;;CAWC,GACD,OAAO,SAASM,gBAAgBC,IAAY,EAAEC,WAAmB;IAC/D,IAAI,CAACH,kBAAkBG,cAAc,OAAOD;IAC5C,MAAME,YAAYF,KAAKG,QAAQ,CAAC,OAAO,MAAM;IAC7C,OAAO,GAAGH,OAAOE,YAAYf,cAAciB,mBAAmBH,eAAe;AAC/E;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASI,gBAAgBL,IAAY;;IAC1C,MAAMM,eAAevB;IACrB,MAAMwB,cAAMD,gCAAAA,aAAcE,GAAG,CAACtB,qCAAsB;IACpD,OAAOD,QAAQ,IAAMc,gBAAgBC,MAAMO,MAAM;QAACP;QAAMO;KAAI;AAC9D;AAEA,OAAO,SAASE;IACd,MAAMC,SAAS5B;IACf,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qCAAqC;IACrC,MAAMwB,eAAevB;IAErB,MAAMkB,cAAchB,QAAQ;;QAC1B,MAAMQ,cAAMa,gCAAAA,aAAcE,GAAG,CAACtB,qCAAsB;QACpD,OAAOY,kBAAkBL,OAAOA,MAAM;IACxC,GAAG;QAACa;KAAa;IAEjB,MAAMK,WAAW3B,YACf,CACES,MAAM,GAAG,EACTmB,KAAyBC,SAAS,EAClCC;QAMA,MAAMC,SAASd,eAAeR;QAC9B,kEAAkE;QAClE,oEAAoE;QACpE,mDAAmD;QACnD,IAAI,eAAeuB,IAAI,CAACD,SAAS;YAC/B,IAAI,OAAOE,WAAW,aAAaA,OAAOC,QAAQ,CAACC,MAAM,CAACJ;YAC1D;QACF;QACA,OAAOL,OAAOU,IAAI,CAACL,QAAQD;IAC7B,GACA;QAACJ;QAAQT;KAAY;IAGvB,OAAOhB,QAAQ;QACb,OAAO;YAACgB;YAAaU;SAAS;IAChC,GAAG;QAACV;QAAaU;KAAS;AAC5B;AAEA,OAAO,SAASU;IACd,MAAMC,WAAWzC;IAEjB,OAAOI,QAAQ;QACb,OAAOmB,mBAAmBkB,YAAY;IACxC,GAAG;QAACA;KAAS;AACf;AAEA,OAAO,SAASC;IACd,MAAMC,UAAUH;IAChB,MAAM,CAACI,SAASd,SAAS,GAAGF;IAE5B,OAAOxB,QACL,IAAM;YAACuC;YAASC;YAASd;SAAS,EAClC;QAACa;QAASC;QAASd;KAAS;AAEhC;AAEA,eAAeY,eAAc"}