@goldstack/template-user-management 0.1.85 → 0.1.87

package/dist/src/client/getEndpoints.d.ts

@@ -5,5 +5,6 @@ export declare function getEndpoint(args: {
     packageSchema: any;
     deploymentsOutput: any;
     deploymentName?: string;
+    state?: string;
 }): Promise<string>;
 //# sourceMappingURL=getEndpoints.d.ts.map

package/dist/src/client/getEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEndpoints.d.ts","sourceRoot":"","sources":["../../../src/client/getEndpoints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,QAAQ,EAGT,MAAM,2BAA2B,CAAC;AAInC,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ClB"}
+{"version":3,"file":"getEndpoints.d.ts","sourceRoot":"","sources":["../../../src/client/getEndpoints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,QAAQ,EAGT,MAAM,2BAA2B,CAAC;AAInC,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDlB"}

package/dist/src/client/getEndpoints.js

@@ -23,13 +23,15 @@ async function getEndpoint(args) {
                 `&client_id=${deploymentOutput.terraform.user_pool_client_id.value}` +
                 `&redirect_uri=${deployment.configuration.callbackUrl}` +
                 '&code_challenge_method=S256' +
-                `&code_challenge=${await (0, getCodeVerifier_1.getCodeChallenge)()}`);
+                `&code_challenge=${await (0, getCodeVerifier_1.getCodeChallenge)()}` +
+                (args.state ? `&state=${encodeURIComponent(args.state)}` : ''));
         case 'signup':
             return (`${baseUrl}/signup?response_type=code` +
                 `&client_id=${deploymentOutput.terraform.user_pool_client_id.value}` +
                 `&redirect_uri=${deployment.configuration.callbackUrl}` +
                 '&code_challenge_method=S256' +
-                `&code_challenge=${await (0, getCodeVerifier_1.getCodeChallenge)()}`);
+                `&code_challenge=${await (0, getCodeVerifier_1.getCodeChallenge)()}` +
+                (args.state ? `&state=${encodeURIComponent(args.state)}` : ''));
         case 'token':
             return `${baseUrl}/oauth2/token`;
         case 'logout':

package/dist/src/client/getEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"getEndpoints.js","sourceRoot":"","sources":["../../../src/client/getEndpoints.ts"],"names":[],"mappings":";;AASA,kCAoDC;AA7DD,4FAAiF;AAMjF,kEAAkF;AAClF,uDAAqD;AAE9C,KAAK,UAAU,WAAW,CAAC,IAMjC;IACC,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qDAAqB,CAAkD;QAC/F,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAA,2CAAoB,EAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEtF,0EAA0E;IAE1E,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,UAAU,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;IACpE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,WAAW;YACd,OAAO,CACL,GAAG,OAAO,sCAAsC;gBAChD,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE,CAC9C,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,OAAO,4BAA4B;gBACtC,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE,CAC9C,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,GAAG,OAAO,eAAe,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,OAAO,4BAA4B;gBACtC,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE,CAC9C,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"getEndpoints.js","sourceRoot":"","sources":["../../../src/client/getEndpoints.ts"],"names":[],"mappings":";;AASA,kCAuDC;AAhED,4FAAiF;AAMjF,kEAAkF;AAClF,uDAAqD;AAE9C,KAAK,UAAU,WAAW,CAAC,IAOjC;IACC,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qDAAqB,CAAkD;QAC/F,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAA,2CAAoB,EAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEtF,0EAA0E;IAE1E,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,UAAU,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;IACpE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,WAAW;YACd,OAAO,CACL,GAAG,OAAO,sCAAsC;gBAChD,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE;gBAC7C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,OAAO,4BAA4B;gBACtC,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE;gBAC7C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/D,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,GAAG,OAAO,eAAe,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,OAAO,4BAA4B;gBACtC,cAAc,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE;gBACpE,iBAAiB,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE;gBACvD,6BAA6B;gBAC7B,mBAAmB,MAAM,IAAA,kCAAgB,GAAE,EAAE,CAC9C,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/src/client/getLoggedInUser.d.ts

@@ -4,6 +4,7 @@
 export interface ClientAuthResult {
     accessToken: string;
     idToken: string;
+    state?: string;
 }
 /**
  * <p>Obtains the information for a user if a user is logged in.

package/dist/src/client/getLoggedInUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getLoggedInUser.d.ts","sourceRoot":"","sources":["../../../src/client/getLoggedInUser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;GAGG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,GAAG,SAAS,CAmB9D;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}
+{"version":3,"file":"getLoggedInUser.d.ts","sourceRoot":"","sources":["../../../src/client/getLoggedInUser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,GAAG,SAAS,CAmB9D;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/src/client/getLoggedInUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"getLoggedInUser.js","sourceRoot":"","sources":["../../../src/client/getLoggedInUser.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAaH,0CAmBC;AAKD,0CAEC;AAhCD,mCAAsC;AAEtC;;;GAGG;AACH,SAAgB,eAAe;IAC7B,IAAI,mBAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpF,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,IAAI,mBAAmB,IAAI,eAAe,EAAE,CAAC;QAC3C,OAAO;YACL,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe;IAC7B,OAAO,eAAe,EAAE,KAAK,SAAS,CAAC;AACzC,CAAC"}
+{"version":3,"file":"getLoggedInUser.js","sourceRoot":"","sources":["../../../src/client/getLoggedInUser.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAcH,0CAmBC;AAKD,0CAEC;AAhCD,mCAAsC;AAEtC;;;GAGG;AACH,SAAgB,eAAe;IAC7B,IAAI,mBAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpF,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,IAAI,mBAAmB,IAAI,eAAe,EAAE,CAAC;QAC3C,OAAO;YACL,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe;IAC7B,OAAO,eAAe,EAAE,KAAK,SAAS,CAAC;AACzC,CAAC"}

package/dist/src/client/handleRedirectCallback.d.ts

@@ -1,6 +1,10 @@
 import type { ClientAuthResult } from './getLoggedInUser';
 /**
- * Handles the redirect callback from the authentication provider
+ * Handles the redirect callback from the authentication provider.
+ *
+ * Note: In browser environments, this function performs a redirect and never returns
+ * to the caller. The return value is only relevant for Jest test environments and
+ * server-side rendering contexts where redirects are not performed.
  */
 export declare function handleRedirectCallback(args: {
     goldstackConfig: any;

package/dist/src/client/handleRedirectCallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleRedirectCallback.d.ts","sourceRoot":"","sources":["../../../src/client/handleRedirectCallback.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAiCxC"}
+{"version":3,"file":"handleRedirectCallback.d.ts","sourceRoot":"","sources":["../../../src/client/handleRedirectCallback.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAqDxC"}

package/dist/src/client/handleRedirectCallback.js

@@ -4,12 +4,15 @@ exports.handleRedirectCallback = handleRedirectCallback;
 const utils_package_config_embedded_1 = require("@goldstack/utils-package-config-embedded");
 const userManagementConfig_1 = require("../userManagementConfig");
 const getAndPersistToken_1 = require("./getAndPersistToken");
+const state_1 = require("./state");
 /**
- * Handles the redirect callback from the authentication provider
+ * Handles the redirect callback from the authentication provider.
+ *
+ * Note: In browser environments, this function performs a redirect and never returns
+ * to the caller. The return value is only relevant for Jest test environments and
+ * server-side rendering contexts where redirects are not performed.
  */
 async function handleRedirectCallback(args) {
-    // if running on the server, such as for rendering a page for SSR, client auth
-    // cannot be performed
     if (typeof window === 'undefined') {
         return;
     }
@@ -18,25 +21,43 @@ async function handleRedirectCallback(args) {
     if (!code) {
         return;
     }
+    const state = params.get('state');
     const deploymentName = (0, userManagementConfig_1.getDeploymentName)(args.deploymentName);
     const token = await (0, getAndPersistToken_1.getAndPersistToken)({ ...args, code });
     const packageConfig = new utils_package_config_embedded_1.EmbeddedPackageConfig({
         goldstackJson: args.goldstackConfig,
         packageSchema: args.packageSchema,
     });
+    // Determine the redirect URL based on deployment type and state
+    let redirectUrl;
     if (deploymentName === 'local') {
-        window.location.href = window.location.href.replace('?code=dummy-local-client-code', '');
+        redirectUrl = window.location.href.split('?')[0];
     }
     else {
         const deployment = packageConfig.getDeployment(deploymentName);
-        window.location.href = deployment.configuration.callbackUrl;
+        redirectUrl = deployment.configuration.callbackUrl;
     }
+    // Apply state redirection if valid
+    if (state) {
+        if ((0, state_1.isValidState)(state)) {
+            redirectUrl = state;
+        }
+        else {
+            console.warn(`Invalid state parameter received: "${state}". ` +
+                `State must be a relative path starting with '/'. ` +
+                `Redirecting to callback URL instead.`);
+        }
+    }
+    // In browser environments, this redirect causes navigation and the function
+    // never returns to the caller. The code below only executes in Jest tests.
+    window.location.href = redirectUrl;
     if (!token) {
         return;
     }
     return {
         accessToken: token.accessToken,
         idToken: token.idToken,
+        state: state || undefined,
     };
 }
 //# sourceMappingURL=handleRedirectCallback.js.map

package/dist/src/client/handleRedirectCallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleRedirectCallback.js","sourceRoot":"","sources":["../../../src/client/handleRedirectCallback.ts"],"names":[],"mappings":";;AAUA,wDAsCC;AAhDD,4FAAiF;AAGjF,kEAA4D;AAC5D,6DAA0D;AAG1D;;GAEG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,8EAA8E;IAC9E,sBAAsB;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,qDAAqB,CAAkD;QAC/F,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"handleRedirectCallback.js","sourceRoot":"","sources":["../../../src/client/handleRedirectCallback.ts"],"names":[],"mappings":";;AAeA,wDA0DC;AAzED,4FAAiF;AAGjF,kEAA4D;AAC5D,6DAA0D;AAE1D,mCAAuC;AAEvC;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,qDAAqB,CAAkD;QAC/F,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,gEAAgE;IAChE,IAAI,WAAmB,CAAC;IACxB,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/D,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,mCAAmC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC;YACxB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,sCAAsC,KAAK,KAAK;gBAC9C,mDAAmD;gBACnD,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;IAEnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,CAAC;AACJ,CAAC"}

package/dist/src/client/operationWithRedirect.d.ts

@@ -8,5 +8,6 @@ export declare function operationWithRedirect(args: {
     deploymentsOutput: any;
     deploymentName?: string;
     operation: 'authorize' | 'signup';
+    state?: string;
 }): Promise<ClientAuthResult | undefined>;
 //# sourceMappingURL=operationWithRedirect.d.ts.map

package/dist/src/client/operationWithRedirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operationWithRedirect.d.ts","sourceRoot":"","sources":["../../../src/client/operationWithRedirect.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,WAAW,GAAG,QAAQ,CAAC;CACnC,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAiExC"}
+{"version":3,"file":"operationWithRedirect.d.ts","sourceRoot":"","sources":["../../../src/client/operationWithRedirect.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,WAAW,GAAG,QAAQ,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAqExC"}

package/dist/src/client/operationWithRedirect.js

@@ -43,7 +43,11 @@ async function operationWithRedirect(args) {
         if ((0, userManagementClientMock_1.getMockedUserAccessToken)() === undefined) {
             return;
         }
-        window.location.href = '?code=dummy-local-client-code';
+        let redirectUrl = '?code=dummy-local-client-code';
+        if (args.state) {
+            redirectUrl += `&state=${encodeURIComponent(args.state)}`;
+        }
+        window.location.href = redirectUrl;
         return;
     }
     const refreshToken = state_1.refreshTokenStorage;

package/dist/src/client/operationWithRedirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"operationWithRedirect.js","sourceRoot":"","sources":["../../../src/client/operationWithRedirect.ts"],"names":[],"mappings":";;AAYA,sDAuEC;AAnFD,0EAAuE;AACvE,kEAA4D;AAC5D,6DAA0D;AAC1D,iDAA6C;AAE7C,qEAAkE;AAElE,mCAAmF;AAEnF;;GAEG;AACI,KAAK,UAAU,qBAAqB,CAAC,IAM3C;IACC,IAAI,mBAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,sBAAsB;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhC,gCAAgC;IAChC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,IAAI,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC;YACrC,GAAG,IAAI;YACP,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAA,+CAAsB,EAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAA,mDAAwB,GAAE,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,+BAA+B,CAAC;QACvD,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,2BAAmB,CAAC;IACzC,8FAA8F;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,iFAAiF;YACjF,IAAA,8BAAsB,EAAC,SAAS,CAAC,CAAC;YAClC,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,0BAAW,EAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAE1E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC;IAChC,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"operationWithRedirect.js","sourceRoot":"","sources":["../../../src/client/operationWithRedirect.ts"],"names":[],"mappings":";;AAYA,sDA4EC;AAxFD,0EAAuE;AACvE,kEAA4D;AAC5D,6DAA0D;AAC1D,iDAA6C;AAE7C,qEAAkE;AAElE,mCAAmF;AAEnF;;GAEG;AACI,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,IAAI,mBAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,wCAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,sBAAsB;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhC,gCAAgC;IAChC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,IAAI,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC;YACrC,GAAG,IAAI;YACP,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAA,+CAAsB,EAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAA,mDAAwB,GAAE,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,WAAW,GAAG,+BAA+B,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,IAAI,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,2BAAmB,CAAC;IACzC,8FAA8F;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAkB,EAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,iFAAiF;YACjF,IAAA,8BAAsB,EAAC,SAAS,CAAC,CAAC;YAClC,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,0BAAW,EAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAE1E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC;IAChC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/client/state.d.ts

@@ -5,4 +5,13 @@ export declare let forceLogout: boolean;
 export declare let refreshTokenStorage: string | undefined;
 export declare function setForceLogout(value: boolean): void;
 export declare function setRefreshTokenStorage(token: string | undefined): void;
+/**
+ * Validates that a state parameter is a safe relative path.
+ * Prevents open redirect vulnerabilities by rejecting absolute URLs
+ * and protocol-relative URLs.
+ *
+ * @param state - The state value to validate
+ * @returns true if the state is a valid relative path
+ */
+export declare function isValidState(state: string): boolean;
 //# sourceMappingURL=state.d.ts.map

package/dist/src/client/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/client/state.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,IAAI,WAAW,SAAQ,CAAC;AAC/B,eAAO,IAAI,mBAAmB,EAAE,MAAM,GAAG,SAAqB,CAAC;AAE/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,QAE5C;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAE/D"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/client/state.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,IAAI,WAAW,SAAQ,CAAC;AAC/B,eAAO,IAAI,mBAAmB,EAAE,MAAM,GAAG,SAAqB,CAAC;AAE/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,QAE5C;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/src/client/state.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.refreshTokenStorage = exports.forceLogout = void 0;
 exports.setForceLogout = setForceLogout;
 exports.setRefreshTokenStorage = setRefreshTokenStorage;
+exports.isValidState = isValidState;
 exports.forceLogout = false;
 exports.refreshTokenStorage = undefined;
 function setForceLogout(value) {
@@ -14,4 +15,15 @@ function setForceLogout(value) {
 function setRefreshTokenStorage(token) {
     exports.refreshTokenStorage = token;
 }
+/**
+ * Validates that a state parameter is a safe relative path.
+ * Prevents open redirect vulnerabilities by rejecting absolute URLs
+ * and protocol-relative URLs.
+ *
+ * @param state - The state value to validate
+ * @returns true if the state is a valid relative path
+ */
+function isValidState(state) {
+    return state.startsWith('/') && !state.startsWith('//') && !state.includes('://');
+}
 //# sourceMappingURL=state.js.map

package/dist/src/client/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/client/state.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAKH,wCAEC;AAED,wDAEC;AATU,QAAA,WAAW,GAAG,KAAK,CAAC;AACpB,QAAA,mBAAmB,GAAuB,SAAS,CAAC;AAE/D,SAAgB,cAAc,CAAC,KAAc;IAC3C,mBAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,2BAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/client/state.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAKH,wCAEC;AAED,wDAEC;AAUD,oCAEC;AArBU,QAAA,WAAW,GAAG,KAAK,CAAC;AACpB,QAAA,mBAAmB,GAAuB,SAAS,CAAC;AAE/D,SAAgB,cAAc,CAAC,KAAc;IAC3C,mBAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,2BAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC"}

package/dist/src/templateUserManagement.d.ts

@@ -10,16 +10,45 @@ export { getLoggedInUser, isAuthenticated } from './client/getLoggedInUser';
 export { handleRedirectCallback } from './client/handleRedirectCallback';
 export { operationWithRedirect } from './client/operationWithRedirect';
 export { performLogout } from './client/performLogout';
+export { isValidState } from './client/state';
 export { connectWithCognito } from './cognitoTokenVerify';
 export { getMockedUserAccessToken, getMockedUserIdToken, setMockedUserAccessToken, setMockedUserIdToken, } from './userManagementClientMock';
 export { generateTestAccessToken, generateTestIdToken, getLocalUserManager, setLocalUserManager, } from './userManagementServerMock';
 export type Endpoint = 'authorize' | 'signup' | 'token' | 'logout';
+/**
+ * Options for login and signup redirect operations.
+ */
+export interface LoginOptions {
+    /**
+     * Override the URL to redirect to after authentication.
+     * By default, the current URL (pathname + search + hash) is preserved.
+     * Must be a relative path starting with '/' (e.g., '/app/dashboard').
+     */
+    targetUrl?: string;
+    /**
+     * If true, redirect to the callback URL instead of preserving the current path.
+     * Useful when you want to always redirect to a default page after authentication.
+     */
+    doNotPreservePath?: boolean;
+}
+/**
+ * Internal arguments for redirect operations.
+ */
+export interface RedirectArgs {
+    goldstackConfig: any;
+    packageSchema: any;
+    deploymentsOutput: any;
+    deploymentName?: string;
+    options?: LoginOptions;
+    operation: 'authorize' | 'signup';
+}
 export declare function getEndpoint(args: {
     goldstackConfig: any;
     endpoint: Endpoint;
     packageSchema: any;
     deploymentsOutput: any;
     deploymentName?: string;
+    state?: string;
 }): Promise<string>;
 export declare function getToken(args: {
     goldstackConfig: any;
@@ -29,28 +58,27 @@ export declare function getToken(args: {
     deploymentsOutput: any;
     deploymentName?: string;
 }): Promise<GetTokenResults | undefined>;
+export declare function loginWithRedirect(args: Omit<RedirectArgs, 'operation'>): Promise<ClientAuthResult | undefined>;
 /**
- * <p>Performs client-side authentication.
- * <p>Will redirect to Cognito hosted UI for sign in if required.
- * <p>Sets client-side cookies and session variables.
- * <p>For more control on what gets persisted on the client-side, use the method <code>getToken</code>.
- */
-export declare function loginWithRedirect(args: {
-    goldstackConfig: any;
-    packageSchema: any;
-    deploymentsOutput: any;
-    deploymentName?: string;
-}): Promise<ClientAuthResult | undefined>;
-/**
- * <p>Performs client-side authentication.
- * <p>Will redirect to Cognito hosted UI for signing up if required.
- * <p>Sets client-side cookies and session variables.
- * <p>For more control on what gets persisted on the client-side, use the method <code>getToken</code>.
+ * Performs client-side sign up.
+ * Will redirect to Cognito hosted UI for signing up if required.
+ * Sets client-side cookies and session variables.
+ *
+ * By default, the current URL (pathname + search + hash) is automatically preserved
+ * and the user will be redirected back after authentication.
+ *
+ * @example
+ * // Auto-preserve current URL
+ * await signUpWithRedirect(args);
+ *
+ * // Specify deployment
+ * await signUpWithRedirect({ ...args, deploymentName: 'prod' });
+ *
+ * // Redirect to specific URL after auth
+ * await signUpWithRedirect({ ...args, options: { targetUrl: '/dashboard' } });
+ *
+ * // Skip path preservation
+ * await signUpWithRedirect({ ...args, options: { doNotPreservePath: true } });
  */
-export declare function signUpWithRedirect(args: {
-    goldstackConfig: any;
-    packageSchema: any;
-    deploymentsOutput: any;
-    deploymentName?: string;
-}): Promise<ClientAuthResult | undefined>;
+export declare function signUpWithRedirect(args: Omit<RedirectArgs, 'operation'>): Promise<ClientAuthResult | undefined>;
 //# sourceMappingURL=templateUserManagement.d.ts.map

package/dist/src/templateUserManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templateUserManagement.d.ts","sourceRoot":"","sources":["../../src/templateUserManagement.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAK9C,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,QAAQ,GAChB,WAAW,GACX,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAElB;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,eAAe,EAAE,GAAG,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEvC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAExC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAExC"}
+{"version":3,"file":"templateUserManagement.d.ts","sourceRoot":"","sources":["../../src/templateUserManagement.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAM9C,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAMpC,MAAM,MAAM,QAAQ,GAChB,WAAW,GACX,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,GAAG,CAAC;IACrB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,WAAW,GAAG,QAAQ,CAAC;CACnC;AA+CD,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAElB;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,eAAe,EAAE,GAAG,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,GAAG,CAAC;IACnB,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEvC;AAyCD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAEvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAEvC"}

package/dist/src/templateUserManagement.js

@@ -36,12 +36,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setLocalUserManager = exports.getLocalUserManager = exports.generateTestIdToken = exports.generateTestAccessToken = exports.setMockedUserIdToken = exports.setMockedUserAccessToken = exports.getMockedUserIdToken = exports.getMockedUserAccessToken = exports.connectWithCognito = exports.performLogout = exports.operationWithRedirect = exports.handleRedirectCallback = exports.isAuthenticated = exports.getLoggedInUser = exports.getCookieSettings = void 0;
+exports.setLocalUserManager = exports.getLocalUserManager = exports.generateTestIdToken = exports.generateTestAccessToken = exports.setMockedUserIdToken = exports.setMockedUserAccessToken = exports.getMockedUserIdToken = exports.getMockedUserAccessToken = exports.connectWithCognito = exports.isValidState = exports.performLogout = exports.operationWithRedirect = exports.handleRedirectCallback = exports.isAuthenticated = exports.getLoggedInUser = exports.getCookieSettings = void 0;
 exports.getEndpoint = getEndpoint;
 exports.getToken = getToken;
 exports.loginWithRedirect = loginWithRedirect;
 exports.signUpWithRedirect = signUpWithRedirect;
 __exportStar(require("./types/UserManagementPackage"), exports);
+const utils_package_config_embedded_1 = require("@goldstack/utils-package-config-embedded");
 const getEndpoints_1 = require("./client/getEndpoints");
 const cognitoClientAuth = __importStar(require("./client/getToken"));
 const operationWithRedirect_1 = require("./client/operationWithRedirect");
@@ -56,6 +57,8 @@ var operationWithRedirect_2 = require("./client/operationWithRedirect");
 Object.defineProperty(exports, "operationWithRedirect", { enumerable: true, get: function () { return operationWithRedirect_2.operationWithRedirect; } });
 var performLogout_1 = require("./client/performLogout");
 Object.defineProperty(exports, "performLogout", { enumerable: true, get: function () { return performLogout_1.performLogout; } });
+var state_1 = require("./client/state");
+Object.defineProperty(exports, "isValidState", { enumerable: true, get: function () { return state_1.isValidState; } });
 var cognitoTokenVerify_1 = require("./cognitoTokenVerify");
 Object.defineProperty(exports, "connectWithCognito", { enumerable: true, get: function () { return cognitoTokenVerify_1.connectWithCognito; } });
 var userManagementClientMock_1 = require("./userManagementClientMock");
@@ -68,6 +71,38 @@ Object.defineProperty(exports, "generateTestAccessToken", { enumerable: true, ge
 Object.defineProperty(exports, "generateTestIdToken", { enumerable: true, get: function () { return userManagementServerMock_1.generateTestIdToken; } });
 Object.defineProperty(exports, "getLocalUserManager", { enumerable: true, get: function () { return userManagementServerMock_1.getLocalUserManager; } });
 Object.defineProperty(exports, "setLocalUserManager", { enumerable: true, get: function () { return userManagementServerMock_1.setLocalUserManager; } });
+/**
+ * Determines the target URL after authentication.
+ * Auto-captures current URL unless doNotPreservePath is set.
+ * Excludes callback URL from auto-capture.
+ */
+function determineTargetUrl(options, deploymentName, packageConfig) {
+    if (options === null || options === void 0 ? void 0 : options.doNotPreservePath) {
+        return undefined;
+    }
+    if (options === null || options === void 0 ? void 0 : options.targetUrl) {
+        return options.targetUrl;
+    }
+    // Auto-capture current URL
+    if (typeof window === 'undefined') {
+        return undefined;
+    }
+    const currentUrl = window.location.pathname + window.location.search + window.location.hash;
+    // Exclude callback URL from auto-capture
+    try {
+        const deployment = packageConfig.getDeployment(deploymentName || 'default');
+        const callbackUrl = deployment.configuration.callbackUrl;
+        const callbackPath = new URL(callbackUrl, window.location.origin).pathname;
+        if (window.location.pathname === callbackPath) {
+            return undefined;
+        }
+    }
+    catch (e) {
+        // If we can't parse callback URL, proceed with auto-capture
+        console.warn('Could not parse callback URL from configuration. Proceeding with auto-capture.', e);
+    }
+    return currentUrl || undefined;
+}
 async function getEndpoint(args) {
     return (0, getEndpoints_1.getEndpoint)(args);
 }
@@ -75,21 +110,66 @@ async function getToken(args) {
     return cognitoClientAuth.getToken(args);
 }
 /**
- * <p>Performs client-side authentication.
- * <p>Will redirect to Cognito hosted UI for sign in if required.
- * <p>Sets client-side cookies and session variables.
- * <p>For more control on what gets persisted on the client-side, use the method <code>getToken</code>.
+ * Performs client-side authentication.
+ * Will redirect to Cognito hosted UI for sign in if required.
+ * Sets client-side cookies and session variables.
+ *
+ * By default, the current URL (pathname + search + hash) is automatically preserved
+ * and the user will be redirected back after authentication.
+ *
+ * @example
+ * // Auto-preserve current URL
+ * await loginWithRedirect(args);
+ *
+ * // Specify deployment
+ * await loginWithRedirect({ ...args, deploymentName: 'prod' });
+ *
+ * // Redirect to specific URL after auth
+ * await loginWithRedirect({ ...args, options: { targetUrl: '/dashboard' } });
+ *
+ * // Skip path preservation
+ * await loginWithRedirect({ ...args, options: { doNotPreservePath: true } });
  */
+async function performRedirect(args) {
+    const packageConfig = new utils_package_config_embedded_1.EmbeddedPackageConfig({
+        goldstackJson: args.goldstackConfig,
+        packageSchema: args.packageSchema,
+    });
+    const state = determineTargetUrl(args.options, args.deploymentName, packageConfig);
+    return (0, operationWithRedirect_1.operationWithRedirect)({
+        goldstackConfig: args.goldstackConfig,
+        packageSchema: args.packageSchema,
+        deploymentsOutput: args.deploymentsOutput,
+        deploymentName: args.deploymentName,
+        operation: args.operation,
+        state,
+    });
+}
 async function loginWithRedirect(args) {
-    return (0, operationWithRedirect_1.operationWithRedirect)({ ...args, operation: 'authorize' });
+    return performRedirect({ ...args, operation: 'authorize' });
 }
 /**
- * <p>Performs client-side authentication.
- * <p>Will redirect to Cognito hosted UI for signing up if required.
- * <p>Sets client-side cookies and session variables.
- * <p>For more control on what gets persisted on the client-side, use the method <code>getToken</code>.
+ * Performs client-side sign up.
+ * Will redirect to Cognito hosted UI for signing up if required.
+ * Sets client-side cookies and session variables.
+ *
+ * By default, the current URL (pathname + search + hash) is automatically preserved
+ * and the user will be redirected back after authentication.
+ *
+ * @example
+ * // Auto-preserve current URL
+ * await signUpWithRedirect(args);
+ *
+ * // Specify deployment
+ * await signUpWithRedirect({ ...args, deploymentName: 'prod' });
+ *
+ * // Redirect to specific URL after auth
+ * await signUpWithRedirect({ ...args, options: { targetUrl: '/dashboard' } });
+ *
+ * // Skip path preservation
+ * await signUpWithRedirect({ ...args, options: { doNotPreservePath: true } });
  */
 async function signUpWithRedirect(args) {
-    return (0, operationWithRedirect_1.operationWithRedirect)({ ...args, operation: 'signup' });
+    return performRedirect({ ...args, operation: 'signup' });
 }
 //# sourceMappingURL=templateUserManagement.js.map

package/dist/src/templateUserManagement.js.map

@@ -1 +1 @@
-{"version":3,"file":"templateUserManagement.js","sourceRoot":"","sources":["../../src/templateUserManagement.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,kCAQC;AAED,4BASC;AAQD,8CAOC;AAQD,gDAOC;AAzFD,gEAA8C;AAE9C,wDAAsE;AACtE,qEAAuD;AAQvD,0EAAuE;AAGvE,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAE1B,4DAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,kHAAA,eAAe,OAAA;AACzC,0EAAyE;AAAhE,gIAAA,sBAAsB,OAAA;AAC/B,wEAAuE;AAA9D,8HAAA,qBAAqB,OAAA;AAC9B,wDAAuD;AAA9C,8GAAA,aAAa,OAAA;AACtB,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA;AAC3B,uEAKoC;AAJlC,oIAAA,wBAAwB,OAAA;AACxB,gIAAA,oBAAoB,OAAA;AACpB,oIAAA,wBAAwB,OAAA;AACxB,gIAAA,oBAAoB,OAAA;AAEtB,uEAKoC;AAJlC,mIAAA,uBAAuB,OAAA;AACvB,+HAAA,mBAAmB,OAAA;AACnB,+HAAA,mBAAmB,OAAA;AACnB,+HAAA,mBAAmB,OAAA;AASd,KAAK,UAAU,WAAW,CAAC,IAMjC;IACC,OAAO,IAAA,0BAAc,EAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAO9B;IACC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CAAC,IAKvC;IACC,OAAO,IAAA,6CAAqB,EAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,OAAO,IAAA,6CAAqB,EAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"templateUserManagement.js","sourceRoot":"","sources":["../../src/templateUserManagement.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyHA,kCASC;AAED,4BASC;AAyCD,8CAIC;AAuBD,gDAIC;AArND,gEAA8C;AAE9C,4FAAiF;AACjF,wDAAsE;AACtE,qEAAuD;AASvD,0EAAuE;AAGvE,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAE1B,4DAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,kHAAA,eAAe,OAAA;AACzC,0EAAyE;AAAhE,gIAAA,sBAAsB,OAAA;AAC/B,wEAAuE;AAA9D,8HAAA,qBAAqB,OAAA;AAC9B,wDAAuD;AAA9C,8GAAA,aAAa,OAAA;AACtB,wCAA8C;AAArC,qGAAA,YAAY,OAAA;AACrB,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA;AAC3B,uEAKoC;AAJlC,oIAAA,wBAAwB,OAAA;AACxB,gIAAA,oBAAoB,OAAA;AACpB,oIAAA,wBAAwB,OAAA;AACxB,gIAAA,oBAAoB,OAAA;AAEtB,uEAKoC;AAJlC,mIAAA,uBAAuB,OAAA;AACvB,+HAAA,mBAAmB,OAAA;AACnB,+HAAA,mBAAmB,OAAA;AACnB,+HAAA,mBAAmB,OAAA;AA0CrB;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,OAAiC,EACjC,cAAkC,EAClC,aAAqF;IAErF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;IAE5F,yCAAyC;IACzC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAE3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4DAA4D;QAC5D,OAAO,CAAC,IAAI,CACV,gFAAgF,EAChF,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAOjC;IACC,OAAO,IAAA,0BAAc,EAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAO9B;IACC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,eAAe,CAAC,IAAkB;IAC/C,MAAM,aAAa,GAAG,IAAI,qDAAqB,CAAkD;QAC/F,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAEnF,OAAO,IAAA,6CAAqB,EAAC;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,IAAqC;IAErC,OAAO,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAqC;IAErC,OAAO,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goldstack/template-user-management",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "description": "Template utilities for user management",
   "keywords": [
     "goldstack",
@@ -38,12 +38,12 @@
   },
   "dependencies": {
     "@goldstack/infra": "0.4.39",
-    "@goldstack/infra-aws": "0.4.59",
+    "@goldstack/infra-aws": "0.4.60",
     "@goldstack/utils-esbuild": "0.5.26",
     "@goldstack/utils-package": "0.4.41",
     "@goldstack/utils-package-config-embedded": "0.5.42",
     "@goldstack/utils-template": "0.4.40",
-    "@goldstack/utils-terraform": "0.4.75",
+    "@goldstack/utils-terraform": "0.4.76",
     "aws-jwt-verify": "^3.2.0",
     "source-map-support": "^0.5.21"
   },