@byline/admin 3.21.0 → 4.0.0

package/dist/modules/auth/components/sign-in-form.d.ts

@@ -1,5 +1,7 @@
-interface SignInFormProps {
-    /** Destination after successful sign-in. Defaults to `/admin`. */
+export interface SignInFormProps {
+    /** Host-validated root-relative destination after successful sign-in. */
+    redirectTo?: string;
+    /** @deprecated Use `redirectTo`. */
     callbackUrl?: string;
     /**
      * Optional plain "Home" link rendered on the left of the action row.
@@ -8,5 +10,4 @@ interface SignInFormProps {
      */
     homeUrl?: string;
 }
-export declare function SignInForm({ callbackUrl, homeUrl }: SignInFormProps): import("react").JSX.Element;
-export {};
+export declare function SignInForm({ redirectTo, callbackUrl, homeUrl }: SignInFormProps): import("react").JSX.Element;

package/dist/modules/auth/components/sign-in-form.js

@@ -1,12 +1,14 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { useState } from "react";
+import { getClientConfig } from "@byline/core";
 import { useTranslation } from "@byline/i18n/react";
 import { Alert, Button, Card, Input, LoaderEllipsis } from "@byline/ui/react";
 import classnames from "classnames";
 import { useBylineAdminServices } from "../../../services/admin-services-context.js";
+import { normalizeRootRelativeRedirect, resolveSignInFormRedirect } from "../safe-redirect.js";
 import sign_in_form_module from "./sign-in-form.module.js";
-function SignInForm({ callbackUrl, homeUrl }) {
+function SignInForm({ redirectTo, callbackUrl, homeUrl }) {
     const { adminSignIn } = useBylineAdminServices();
     const { t } = useTranslation('byline-admin');
     const [email, setEmail] = useState('');
@@ -17,6 +19,7 @@ function SignInForm({ callbackUrl, homeUrl }) {
         event.preventDefault();
         if (pending) return;
         if (0 === email.trim().length || 0 === password.length) return void setError(t('auth.signIn.errors.empty'));
+        const destination = resolveSignInFormRedirect(redirectTo, callbackUrl, getClientConfig().routes.admin);
         setPending(true);
         setError(null);
         try {
@@ -26,13 +29,13 @@ function SignInForm({ callbackUrl, homeUrl }) {
                     password
                 }
             });
-            const target = callbackUrl && callbackUrl.length > 0 ? callbackUrl : '/admin';
-            window.location.assign(target);
         } catch (err) {
             console.warn('sign-in failed', err);
             setError(t('auth.signIn.errors.invalidCredentials'));
             setPending(false);
+            return;
         }
+        window.location.assign(normalizeRootRelativeRedirect(destination) ?? '/');
     }
     return /*#__PURE__*/ jsxs(Card, {
         className: classnames('byline-sign-in-card', sign_in_form_module.card),

package/dist/modules/auth/safe-redirect.d.ts

@@ -0,0 +1,4 @@
+/** Accept only canonical, unencoded, root-relative same-origin redirect paths. */
+export declare function normalizeRootRelativeRedirect(value: string): string | undefined;
+/** Resolve the new prop first, then the deprecated prop, then a trusted fallback. */
+export declare function resolveSignInFormRedirect(redirectTo: string | undefined, callbackUrl: string | undefined, fallback: string | (() => string)): string;

package/dist/modules/auth/safe-redirect.js

@@ -0,0 +1,20 @@
+import { normalizeRootRelativeRedirect } from "@byline/core";
+function safe_redirect_normalizeRootRelativeRedirect(value) {
+    const normalized = normalizeRootRelativeRedirect(value);
+    if (!normalized) return;
+    let url;
+    try {
+        url = new URL(normalized, 'https://byline.invalid');
+    } catch  {
+        return;
+    }
+    if ('https://byline.invalid' !== url.origin) return;
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+function resolveSignInFormRedirect(redirectTo, callbackUrl, fallback) {
+    const requested = (redirectTo ? safe_redirect_normalizeRootRelativeRedirect(redirectTo) : void 0) ?? (callbackUrl ? safe_redirect_normalizeRootRelativeRedirect(callbackUrl) : void 0);
+    if (requested) return requested;
+    const defaultPath = 'function' == typeof fallback ? fallback() : fallback;
+    return safe_redirect_normalizeRootRelativeRedirect(defaultPath) ?? '/';
+}
+export { resolveSignInFormRedirect, safe_redirect_normalizeRootRelativeRedirect as normalizeRootRelativeRedirect };

package/dist/modules/auth/safe-redirect.test.node.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/auth/sign-in-form-props.test.node.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "3.21.0",
+  "version": "4.0.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -155,10 +155,10 @@
     "react-diff-viewer-continued": "^4.2.2",
     "uuid": "^14.0.1",
     "zod": "^4.4.3",
-    "@byline/auth": "3.21.0",
-    "@byline/ui": "3.21.0",
-    "@byline/i18n": "3.21.0",
-    "@byline/core": "3.21.0"
+    "@byline/auth": "4.0.0",
+    "@byline/core": "4.0.0",
+    "@byline/ui": "4.0.0",
+    "@byline/i18n": "4.0.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/modules/auth/components/sign-in-form.tsx

@@ -12,8 +12,8 @@
  * Admin sign-in form.
  *
  * Client component — collects email + password, calls the `adminSignIn`
- * server fn, and on success navigates to the caller-supplied
- * `callbackUrl` (or `/admin`). On failure renders a generic "Invalid
+ * server fn, and on success navigates to a safe caller-supplied destination.
+ * On failure renders a generic "Invalid
  * credentials" alert; the provider equalises timing between
  * unknown-email and wrong-password so the UI doesn't distinguish the two.
  *
@@ -25,15 +25,19 @@
 
 import { type FormEvent, useState } from 'react'
 
+import { getClientConfig } from '@byline/core'
 import { useTranslation } from '@byline/i18n/react'
 import { Alert, Button, Card, Input, LoaderEllipsis } from '@byline/ui/react'
 import cx from 'classnames'
 
 import { useBylineAdminServices } from '../../../services/admin-services-context.js'
+import { normalizeRootRelativeRedirect, resolveSignInFormRedirect } from '../safe-redirect.js'
 import styles from './sign-in-form.module.css'
 
-interface SignInFormProps {
-  /** Destination after successful sign-in. Defaults to `/admin`. */
+export interface SignInFormProps {
+  /** Host-validated root-relative destination after successful sign-in. */
+  redirectTo?: string
+  /** @deprecated Use `redirectTo`. */
   callbackUrl?: string
   /**
    * Optional plain "Home" link rendered on the left of the action row.
@@ -43,7 +47,7 @@ interface SignInFormProps {
   homeUrl?: string
 }
 
-export function SignInForm({ callbackUrl, homeUrl }: SignInFormProps) {
+export function SignInForm({ redirectTo, callbackUrl, homeUrl }: SignInFormProps) {
   const { adminSignIn } = useBylineAdminServices()
   const { t } = useTranslation('byline-admin')
   const [email, setEmail] = useState('')
@@ -59,19 +63,26 @@ export function SignInForm({ callbackUrl, homeUrl }: SignInFormProps) {
       return
     }
 
+    const destination = resolveSignInFormRedirect(
+      redirectTo,
+      callbackUrl,
+      getClientConfig().routes.admin
+    )
+
     setPending(true)
     setError(null)
     try {
       await adminSignIn({ data: { email: email.trim(), password } })
-      const target = callbackUrl && callbackUrl.length > 0 ? callbackUrl : '/admin'
-      // Full-page navigation — the admin layout needs to re-run its
-      // `beforeLoad` guard against the freshly-set session cookies.
-      window.location.assign(target)
     } catch (err) {
       console.warn('sign-in failed', err)
       setError(t('auth.signIn.errors.invalidCredentials'))
       setPending(false)
+      return
     }
+
+    // Keep navigation outside the credential error boundary. A browser-level
+    // navigation failure must not relabel a successful sign-in as bad credentials.
+    window.location.assign(normalizeRootRelativeRedirect(destination) ?? '/')
   }
 
   return (

package/src/modules/auth/safe-redirect.test.node.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+
+import { normalizeRootRelativeRedirect, resolveSignInFormRedirect } from './safe-redirect.js'
+
+describe('normalizeRootRelativeRedirect', () => {
+  it.each([
+    ['/cms', '/cms'],
+    ['/cms/account?tab=profile#name', '/cms/account?tab=profile#name'],
+  ])('accepts %j', (value, expected) => {
+    expect(normalizeRootRelativeRedirect(value)).toBe(expected)
+  })
+
+  it.each([
+    '',
+    ' /cms',
+    'https://evil.test',
+    '//evil.test',
+    '/\\evil.test',
+    '/cms\\account',
+    '/cms\naccount',
+    '%2Fcms',
+    '/%2F%2Fevil.test',
+    '/cms/%5cevil.test',
+    '/cms/%2e/account',
+    '/cms/../account',
+    '/cms/./account',
+    '/cms\u0085account',
+  ])('rejects %j', (value) => {
+    expect(normalizeRootRelativeRedirect(value)).toBeUndefined()
+  })
+})
+
+describe('resolveSignInFormRedirect', () => {
+  it('prefers a safe redirectTo over the deprecated callbackUrl', () => {
+    expect(resolveSignInFormRedirect('/cms/account', '/cms/users', '/cms')).toBe('/cms/account')
+    expect(
+      resolveSignInFormRedirect('/cms/account', undefined, () => {
+        throw new Error('fallback must be lazy')
+      })
+    ).toBe('/cms/account')
+  })
+
+  it('supports a safe deprecated callbackUrl when redirectTo is absent or unsafe', () => {
+    expect(resolveSignInFormRedirect(undefined, '/cms/users', '/cms')).toBe('/cms/users')
+    expect(resolveSignInFormRedirect('https://evil.test', '/cms/users', '/cms')).toBe('/cms/users')
+  })
+
+  it('uses the safe configured fallback without permitting an open redirect', () => {
+    expect(resolveSignInFormRedirect('//evil.test', 'https://evil.test', '/cms')).toBe('/cms')
+    expect(resolveSignInFormRedirect(undefined, undefined, 'https://evil.test')).toBe('/')
+  })
+})

package/src/modules/auth/safe-redirect.ts

@@ -0,0 +1,33 @@
+import { normalizeRootRelativeRedirect as normalizeCoreRedirect } from '@byline/core'
+
+/** Accept only canonical, unencoded, root-relative same-origin redirect paths. */
+export function normalizeRootRelativeRedirect(value: string): string | undefined {
+  const normalized = normalizeCoreRedirect(value)
+  if (!normalized) return undefined
+
+  // Keep an origin check next to the navigation sink even if core validation changes.
+  let url: URL
+  try {
+    url = new URL(normalized, 'https://byline.invalid')
+  } catch {
+    return undefined
+  }
+
+  if (url.origin !== 'https://byline.invalid') return undefined
+  return `${url.pathname}${url.search}${url.hash}`
+}
+
+/** Resolve the new prop first, then the deprecated prop, then a trusted fallback. */
+export function resolveSignInFormRedirect(
+  redirectTo: string | undefined,
+  callbackUrl: string | undefined,
+  fallback: string | (() => string)
+): string {
+  const requested =
+    (redirectTo ? normalizeRootRelativeRedirect(redirectTo) : undefined) ??
+    (callbackUrl ? normalizeRootRelativeRedirect(callbackUrl) : undefined)
+  if (requested) return requested
+
+  const defaultPath = typeof fallback === 'function' ? fallback() : fallback
+  return normalizeRootRelativeRedirect(defaultPath) ?? '/'
+}

package/src/modules/auth/sign-in-form-props.test.node.ts

@@ -0,0 +1,14 @@
+import { describe, expectTypeOf, it } from 'vitest'
+
+import type { SignInFormProps } from './components/sign-in-form.js'
+
+describe('SignInFormProps', () => {
+  it('keeps legacy callbackUrl-only callers type-compatible', () => {
+    expectTypeOf<{ callbackUrl: string }>().toMatchTypeOf<SignInFormProps>()
+  })
+
+  it('accepts the preferred redirectTo prop and no destination prop', () => {
+    expectTypeOf<{ redirectTo: string }>().toMatchTypeOf<SignInFormProps>()
+    expectTypeOf<Record<string, never>>().toMatchTypeOf<SignInFormProps>()
+  })
+})