@autobusal/providers 1.40.2 → 1.40.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.40.3
+
+### Fixed
+
+- **An expired session interrupted on a private page carries that page through the logout hop** (`/account/logout?return=...`), so signing back in can resume there. (Audit ADM-08a.)
+
 ## 1.40.2
 
 ### Fixed

package/Queries/apiClient.ts

@@ -112,7 +112,20 @@ apiClient.interceptors.response.use(response => (
         }
       }
 
-      window.location.href = '/account/logout';
+      /*
+       * Claude - 2026-08-22 (audit finding ADM-08a): when the dead session
+       * was interrupted on a private page, carry that page through the
+       * logout hop - Logout hands it to the login screen, and a successful
+       * sign-in lands back where the bookmark pointed instead of on the
+       * storefront with no explanation.
+       */
+      const here = window.location.pathname;
+
+      const isPrivate = ['/admin', '/account', '/operator'].some(prefix => here.startsWith(prefix));
+
+      window.location.href = isPrivate
+        ? '/account/logout?return=' + encodeURIComponent(here + window.location.search)
+        : '/account/logout';
 
       return Promise.reject(error);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.40.2",
+  "version": "1.40.3",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"