@authup/client-web-nuxt 1.0.0-beta.62 → 1.0.0-beta.63

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@authup/client-web-nuxt",
   "configKey": "authup",
-  "version": "1.0.0-beta.62",
+  "version": "1.0.0-beta.63",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/helpers/routing-interceptor.d.ts

@@ -8,6 +8,27 @@ export declare class RoutingInterceptor {
     protected loginRoute: string;
     constructor(nuxtApp: NuxtApp);
     execute(to: RouteLocationNormalized, from: RouteLocationNormalized): Promise<RouteLocationAsPathGeneric | undefined>;
+    /**
+     * Resolve a post-login destination, or undefined when the value is not a
+     * site-relative path.
+     *
+     * The base is a fixed dummy origin, so a value that lands anywhere else
+     * declared an authority of its own and is refused. That covers the whole
+     * family in one comparison — `//host`, `https://host`, the `\`-for-`/`
+     * variants a prefix check misses, and non-special schemes, which resolve
+     * to the opaque `"null"` origin.
+     */
+    protected resolveDestination(value: string): URL | undefined;
+    protected withoutAuthorizationParams(route: RouteLocationNormalized): RouteLocationAsPathGeneric;
+    /**
+     * Return to a route the user already had.
+     *
+     * Passing `fullPath` as `path` looks equivalent and is not: vue-router
+     * runs it through `parseURL`, which keeps the path and silently discards
+     * the query and hash, so a bounce off `/users?page=2#row-7` used to land
+     * on a bare `/users`.
+     */
+    protected backTo(route: RouteLocationNormalized): RouteLocationAsPathGeneric;
     protected hasLoggedInCondition(route: RouteLocationNormalized): boolean;
     protected validateLoggedInCondition(route: RouteLocationNormalized): boolean;
     protected hasLoggedOutCondition(route: RouteLocationNormalized): boolean;

package/dist/runtime/helpers/routing-interceptor.js

@@ -8,6 +8,7 @@ import {
 import { hasOwnProperty, omitRecord } from "@authup/kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { RouteMetaKey } from "../constants.js";
+const DESTINATION_BASE = "http://localhost";
 export class RoutingInterceptor {
   store;
   storeRefs;
@@ -27,6 +28,8 @@ export class RoutingInterceptor {
         return void 0;
       }
       const request = loadAuthorizationRequest();
+      const { redirect } = to.query;
+      const destination = typeof redirect === "string" ? this.resolveDestination(redirect) : void 0;
       try {
         if (request) {
           const state = typeof to.query.state === "string" ? to.query.state : void 0;
@@ -43,26 +46,22 @@ export class RoutingInterceptor {
           await this.store.exchangeAuthorizationCode(code);
         }
         clearAuthorizationRequest();
-        if (request?.target) {
-          const url = new URL(request.target, "http://localhost");
+        if (destination) {
+          const query = {};
+          for (const key of new Set(destination.searchParams.keys())) {
+            const values = destination.searchParams.getAll(key);
+            query[key] = values.length > 1 ? values : values[0];
+          }
           return {
-            path: url.pathname,
-            query: Object.fromEntries(url.searchParams.entries()),
-            hash: url.hash
+            path: destination.pathname,
+            query,
+            hash: destination.hash
           };
         }
-        return {
-          path: to.path,
-          query: omitRecord(to.query, ["code", "state"]),
-          hash: to.hash
-        };
+        return this.withoutAuthorizationParams(to);
       } catch {
         clearAuthorizationRequest();
-        return {
-          path: to.path,
-          query: omitRecord(to.query, ["code", "state"]),
-          hash: to.hash
-        };
+        return this.withoutAuthorizationParams(to);
       }
     }
     try {
@@ -101,12 +100,59 @@ export class RoutingInterceptor {
       }
       if (this.hasLoggedOutCondition(from)) {
         await this.store.logout();
-        return { path: from.fullPath };
+        return this.backTo(from);
+      }
+      if (typeof from.query.code === "string") {
+        return { path: this.homeRoute };
       }
-      return { path: from.fullPath };
+      return this.backTo(from);
     }
     return void 0;
   }
+  /**
+   * Resolve a post-login destination, or undefined when the value is not a
+   * site-relative path.
+   *
+   * The base is a fixed dummy origin, so a value that lands anywhere else
+   * declared an authority of its own and is refused. That covers the whole
+   * family in one comparison — `//host`, `https://host`, the `\`-for-`/`
+   * variants a prefix check misses, and non-special schemes, which resolve
+   * to the opaque `"null"` origin.
+   */
+  resolveDestination(value) {
+    if (!value) {
+      return void 0;
+    }
+    let url;
+    try {
+      url = new URL(value, DESTINATION_BASE);
+    } catch {
+      return void 0;
+    }
+    return url.origin === DESTINATION_BASE ? url : void 0;
+  }
+  withoutAuthorizationParams(route) {
+    return {
+      path: route.path,
+      query: omitRecord(route.query, ["code", "state", "redirect"]),
+      hash: route.hash
+    };
+  }
+  /**
+   * Return to a route the user already had.
+   *
+   * Passing `fullPath` as `path` looks equivalent and is not: vue-router
+   * runs it through `parseURL`, which keeps the path and silently discards
+   * the query and hash, so a bounce off `/users?page=2#row-7` used to land
+   * on a bare `/users`.
+   */
+  backTo(route) {
+    return {
+      path: route.path,
+      query: route.query,
+      hash: route.hash
+    };
+  }
   hasLoggedInCondition(route) {
     return route.matched.some(
       (matched) => !!matched.meta[RouteMetaKey.REQUIRE_LOGGED_IN]

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/client-web-nuxt",
     "type": "module",
-    "version": "1.0.0-beta.62",
+    "version": "1.0.0-beta.63",
     "description": "Nuxt module for the authup ecosystem",
     "license": "Apache-2.0",
     "repository": {
@@ -24,16 +24,17 @@
         "build": "nuxt-module-build prepare && nuxt-module-build build",
         "prepack": "nuxt-module-build prepare && nuxt-module-build build",
         "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
-        "lint": "eslint ."
+        "lint": "eslint .",
+        "test": "nuxt-module-build prepare && cross-env NODE_ENV=test vitest run --config test/vitest.config.ts"
     },
     "engines": {
         "node": "^22.13.0 || ^23.5.0 || >=24.0.0"
     },
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.62",
-        "@authup/client-web-kit": "^1.0.0-beta.62",
-        "@authup/core-http-kit": "^1.0.0-beta.62",
-        "@authup/kit": "^1.0.0-beta.62",
+        "@authup/access": "^1.0.0-beta.63",
+        "@authup/client-web-kit": "^1.0.0-beta.63",
+        "@authup/core-http-kit": "^1.0.0-beta.63",
+        "@authup/kit": "^1.0.0-beta.63",
         "@nuxt/kit": "^4.0.0",
         "pathtrace": "^2.2.0",
         "smob": "^1.6.1"
@@ -42,12 +43,15 @@
         "@nuxt/module-builder": "^1.0.3",
         "@nuxt/schema": "^4.0.0",
         "@pinia/nuxt": "^1.0.1",
+        "cross-env": "^10.1.0",
         "fix-dts-default-cjs-exports": "^1.0.1",
         "mkdist": "^2.3.0",
         "nuxt": "^4.5.2",
         "pinia": "^4.0.2",
         "rollup-plugin-dts": "^6.5.1",
-        "strip-literal": "^3.1.0",
+        "strip-literal": "^4.0.0",
+        "vitest": "^4.0.14",
+        "vue": "^3.5.41",
         "vue-router": "^5.0.7"
     },
     "peerDependencies": {