@frigear-nu/authorization 0.1.1 → 0.1.3

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@frigear-nu/authorization",
   "configKey": "authorization",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/runtime/app/middleware/authorization.global.js

@@ -1,4 +1,4 @@
-import { evaluateRule, normalizeAuthorizeMeta, resolveRule } from "../../utils/index.js";
+import { evaluateRule, loginRedirect, normalizeAuthorizeMeta, resolveRule } from "../../utils/index.js";
 import { abilities } from "#build/authorization/abilities.mjs";
 import resolveClientUser from "#build/authorization/client-resolver.mjs";
 import { abortNavigation, createError, defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#imports";
@@ -11,7 +11,8 @@ export default defineNuxtRouteMiddleware(async (to) => {
   const response = await evaluateRule(rule, user, abilities);
   if (response.authorized) return;
   if (response.statusCode === 401 && config?.redirectTo) {
-    return navigateTo(config.redirectTo);
+    const target = loginRedirect(config.redirectTo, to.fullPath);
+    return navigateTo(target, { external: typeof target === "string" && /^https?:\/\//.test(target) });
   }
   return abortNavigation(createError({ statusCode: response.statusCode ?? 403, message: response.message }));
 });

package/dist/runtime/utils/index.d.ts

@@ -4,3 +4,4 @@ export * from './ability.js';
 export * from './bouncer.js';
 export * from './rules.js';
 export * from './roles.js';
+export * from './redirect.js';

package/dist/runtime/utils/index.js

@@ -4,3 +4,4 @@ export * from "./ability.js";
 export * from "./bouncer.js";
 export * from "./rules.js";
 export * from "./roles.js";
+export * from "./redirect.js";

package/dist/runtime/utils/redirect.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Where a guest goes from a page that requires sign in: `redirectTo` with `?redirect=<the page>`, so the sign-in page
+ * can send them back (`useAfterLogin` of `@frigear-nu/auth`). Only same-site paths are passed along; an absolute
+ * `redirectTo` URL is returned as configured.
+ */
+export declare function loginRedirect(redirectTo: string, fullPath: string): string | {
+    path: string;
+    query: {
+        redirect: string;
+    };
+};

package/dist/runtime/utils/redirect.js

@@ -0,0 +1,6 @@
+const isInternalPath = (value) => typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\");
+export function loginRedirect(redirectTo, fullPath) {
+  if (!isInternalPath(redirectTo) || !isInternalPath(fullPath)) return redirectTo;
+  if (fullPath.split(/[?#]/)[0] === redirectTo) return redirectTo;
+  return { path: redirectTo, query: { redirect: fullPath } };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frigear-nu/authorization",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Policy-based authorization (abilities, resolvers, route rules, <Can>) for the frigear ecosystem, built on @frigear-nu/users.",
   "homepage": "https://docs.frigear.dev/modules/authorization",
   "repository": {
@@ -30,9 +30,9 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/module-kit": "1.1.1",
-    "@frigear-nu/auth": "0.1.2",
-    "@frigear-nu/users": "1.1.2",
+    "@frigear-nu/module-kit": "1.1.3",
+    "@frigear-nu/auth": "0.1.4",
+    "@frigear-nu/users": "1.1.4",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.1",
     "drizzle-kit": "^0.31.11",