@greatapps/common 1.1.785 → 1.1.787

package/src/middlewares/create-auth-middleware.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 
 import { continueChain, MiddlewareConfig, MiddlewareFunction, MiddlewareResult, stopChain } from './types';
 import { whitelabelService } from '../modules/whitelabel/services/whitelabel.service';
+import { isSameSiteUrl } from '../utils/redirect';
 
 function isRouteEquals(pathname: string, routes: string[]): boolean {
   return routes.some((route) => pathname === route || pathname.startsWith(`${route}/`));
@@ -27,8 +28,18 @@ export function createAuthMiddleware(options?: CreateAuthMiddlewareOptions): Mid
       const host = request.headers.get('host') || '';
       const whitelabel = await whitelabelService.getTokenByDomain(host).catch(() => null);
       const accountsUrl = whitelabel?.accounts_url;
+      const accountsUrlIsSameSite = !!accountsUrl && isSameSiteUrl(accountsUrl, host);
+
+      if (accountsUrl && !accountsUrlIsSameSite) {
+        console.error('[auth-middleware] accounts_url fora do site do host da requisição', {
+          host,
+          pathname,
+          whitelabelId: whitelabel?.id,
+          accountsUrl,
+        });
+      }
 
-      const loginUrl = accountsUrl
+      const loginUrl = accountsUrlIsSameSite
         ? new URL('/login', accountsUrl)
         : new URL('/login', request.url);
 

package/src/modules/auth/utils/assert-account-not-frozen.ts

@@ -1,22 +1,23 @@
 import "server-only";
 
 import { ApiError } from "../../../infra/api/types";
-import { listSubscriptionsAction } from "../../subscriptions/actions/list-subscriptions.action";
+import { readCurrentSubscription } from "../../subscriptions/utils/read-current-subscription";
 import { getAccountFreezeState } from "../../subscriptions/utils/get-account-freeze-state";
+import type { Subscription } from "../../subscriptions/types/subscription.type";
 
 export async function assertAccountNotFrozen(): Promise<void> {
-  const result = await listSubscriptionsAction({ active: true });
+  let subscription: Subscription | null;
 
-  if (!result.success) {
+  try {
+    subscription = await readCurrentSubscription();
+  } catch (error) {
     console.error(
       "[assertAccountNotFrozen] failed to read subscription context:",
-      result.error,
+      error,
     );
     return;
   }
 
-  const subscription = result.data?.data?.[0];
-
   if (!subscription) return;
 
   if (getAccountFreezeState(subscription) !== "frozen") return;

package/src/modules/auth/utils/assert-management-subscription.ts

@@ -1,32 +1,23 @@
 import "server-only";
 
-import { cache } from "react";
-
 import { ApiError } from "../../../infra/api/types";
-import { listSubscriptionsAction } from "../../subscriptions/actions/list-subscriptions.action";
+import { readCurrentSubscription } from "../../subscriptions/utils/read-current-subscription";
+import { getSubscriptionCancellationState } from "../../subscriptions/utils/get-subscription-cancellation-state";
 import { getSubscriptionExpiryDate } from "../../subscriptions/utils/get-subscription-expiry-date";
 
 /**
- * Deduplicado por request via React.cache, como `getCurrentUserProfile` e `requireValidSession`.
+ * A leitura por trás (`readCurrentSubscription`) já é deduplicada por request via
+ * React.cache, então não precisa de outra camada aqui: em produção (26/08) o mesmo
+ * carregamento disparava até quatro cópias da mesma pergunta em paralelo, com 727 ms,
+ * 4,2 s, 5,0 s e 7,0 s, contra um p50 de 528 ms; agora é uma leitura só,
+ * compartilhada pelos quatro gates.
  *
- * A leitura por trás é `/accounts/{id}/subscriptions?limit=1`, e ela é MAIS cara que o gate de
- * perfil: para conta Stripe a listagem consulta a API do gateway ao vivo. Em produção (26/08) o
- * mesmo carregamento disparou quatro dessas em paralelo — 727 ms, 4,2 s, 5,0 s e 7,0 s, contra um
- * p50 de 528 ms para o endpoint. Elas se atrasam entre si: são cópias da mesma pergunta disputando
- * a mesma fila.
+ * A checagem de cancelamento é obrigatória além da de vencimento: a corrente pode
+ * vir com `active: false` (baixa por falha de pagamento) com `date_due` ainda no
+ * futuro, caso que só `getSubscriptionExpiryDate` não cobre.
  */
-export const assertManagementSubscription = cache(async () => {
-  const result = await listSubscriptionsAction({ active: true });
-
-  if (!result.success) {
-    throw new ApiError(
-      result.error || "Não foi possível validar a assinatura atual",
-      "SUBSCRIPTION_CONTEXT_FAILED",
-      403,
-    );
-  }
-
-  const subscription = result.data?.data?.[0];
+export async function assertManagementSubscription(): Promise<void> {
+  const subscription = await readCurrentSubscription();
 
   if (!subscription) {
     throw new ApiError(
@@ -36,14 +27,15 @@ export const assertManagementSubscription = cache(async () => {
     );
   }
 
+  const isCancelled = getSubscriptionCancellationState(subscription) === "cancelled";
   const expiryDate = getSubscriptionExpiryDate(subscription);
   const isExpired = !!expiryDate && Date.now() >= expiryDate.getTime();
 
-  if (isExpired) {
+  if (isCancelled || isExpired) {
     throw new ApiError(
       "Sua assinatura está vencida. Assine um novo plano para continuar.",
       "SUBSCRIPTION_EXPIRED",
       403,
     );
   }
-});
+}

package/src/modules/auth/utils/assert-paid-subscription.ts

@@ -1,21 +1,13 @@
 import "server-only";
 
 import { ApiError } from "../../../infra/api/types";
-import { listSubscriptionsAction } from "../../subscriptions/actions/list-subscriptions.action";
+import { readCurrentSubscription } from "../../subscriptions/utils/read-current-subscription";
+import { getSubscriptionCancellationState } from "../../subscriptions/utils/get-subscription-cancellation-state";
 import { getSubscriptionExpiryDate } from "../../subscriptions/utils/get-subscription-expiry-date";
+import { FREE_PLAN_ID } from "../../subscriptions/constants/subscription.constants";
 
 export async function assertPaidSubscription() {
-  const result = await listSubscriptionsAction({ active: true });
-
-  if (!result.success) {
-    throw new ApiError(
-      result.error || "Não foi possível validar a assinatura atual",
-      "SUBSCRIPTION_CONTEXT_FAILED",
-      403,
-    );
-  }
-
-  const subscription = result.data?.data?.[0];
+  const subscription = await readCurrentSubscription();
 
   if (!subscription) {
     throw new ApiError(
@@ -25,10 +17,11 @@ export async function assertPaidSubscription() {
     );
   }
 
+  const isCancelled = getSubscriptionCancellationState(subscription) === "cancelled";
   const expiryDate = getSubscriptionExpiryDate(subscription);
   const isExpired = !!expiryDate && Date.now() >= expiryDate.getTime();
 
-  if (isExpired) {
+  if (isCancelled || isExpired) {
     throw new ApiError(
       "Sua assinatura está vencida. Assine um novo plano para continuar.",
       "SUBSCRIPTION_EXPIRED",
@@ -36,8 +29,7 @@ export async function assertPaidSubscription() {
     );
   }
 
-  
-  if (subscription.type === 'free' || subscription.id_plan === 5) {
+  if (subscription.type === 'free' || subscription.id_plan === FREE_PLAN_ID) {
     throw new ApiError(
       "Este recurso está disponível apenas para planos pagos. Faça upgrade do seu plano para continuar.",
       "PAID_SUBSCRIPTION_REQUIRED",

package/src/modules/auth/utils/assert-subscription-addon.ts

@@ -1,24 +1,14 @@
 import "server-only";
 
 import { ApiError } from "../../../infra/api/types";
-import { listSubscriptionsAction } from "../../subscriptions/actions/list-subscriptions.action";
+import { readCurrentSubscription } from "../../subscriptions/utils/read-current-subscription";
 import type { AddonKindEnum } from "../../subscriptions/constants/addons.constants";
 
 export async function assertSubscriptionAddon(
   addonId: AddonKindEnum,
   addonLabel: string,
 ) {
-  const result = await listSubscriptionsAction({ active: true });
-
-  if (!result.success) {
-    throw new ApiError(
-      result.error || "Não foi possível validar a assinatura atual",
-      "SUBSCRIPTION_CONTEXT_FAILED",
-      403,
-    );
-  }
-
-  const subscription = result.data?.data?.[0];
+  const subscription = await readCurrentSubscription();
 
   if (!subscription) {
     throw new ApiError(

package/src/modules/plans/hooks/use-plan-by-id.hook.ts

@@ -11,7 +11,7 @@ export function usePlanById(idPlan?: number | string | null) {
   const queryClient = useQueryClient();
   const plansKey = useAuthQueryKey([...PLANS_QUERY_KEY]);
 
-  return useQuery({
+  return useQuery<SuccessResult<Plan>>({
     queryKey: [...plansKey, idPlan],
     queryFn: ({ signal }) =>
       apiFetch<SuccessResult<Plan>>(`/api/plans/${idPlan}`, { signal }),

package/src/modules/subscriptions/actions/get-current-subscription.action.ts

@@ -0,0 +1,8 @@
+'use server';
+
+import { safeServerAction } from '../../../utils/safeServerAction';
+import { subscriptionsService } from '../services/subscriptions.service';
+
+export async function getCurrentSubscriptionAction(params?: { id_product?: number }) {
+  return safeServerAction(() => subscriptionsService.getCurrentSubscription(params));
+}

package/src/modules/subscriptions/constants/subscription.constants.ts

@@ -6,3 +6,6 @@ export const FREEZE_WARNING_DAYS_BEFORE = 1;
 export const FREEZE_ELIGIBLE_WHITELABEL_ID = 1;
 
 export const MAX_PAYMENT_ATTEMPTS = 8;
+
+/** Plano legado "FREE" identificado por `id_plan`, fora do `type: 'free'` moderno. */
+export const FREE_PLAN_ID = 5;

package/src/modules/subscriptions/handlers/current-subscription.handler.ts

@@ -0,0 +1,16 @@
+import 'server-only';
+
+import type { NextRequest } from 'next/server';
+import { safeRouteHandler } from '../../../infra/route/safe-route-handler';
+import { searchParamsToParams } from '../../../infra/route/search-params';
+import { subscriptionsService } from '../services/subscriptions.service';
+
+export function createCurrentSubscriptionHandler() {
+  return async function GET(req: NextRequest) {
+    return safeRouteHandler(() =>
+      subscriptionsService.getCurrentSubscription(
+        searchParamsToParams<{ id_product?: number }>(req.nextUrl.searchParams),
+      ),
+    );
+  };
+}

package/src/modules/subscriptions/hooks/find-active-subscription.hook.ts

@@ -1,22 +1,12 @@
 "use client";
 
-import { useQuery } from "@tanstack/react-query";
-import { apiFetch } from "../../../infra/http/api-fetch";
-import type { PaginatedSuccessResult } from "../../../infra/api/types";
-import type { Subscription } from "../types/subscription.type";
-import { SUBSCRIPTIONS_QUERY_KEY } from "../constants/query-keys.constants";
-import { useAuthQueryKey } from "../../../hooks/useAuthQueryKey";
+import { useCurrentSubscription } from "./use-current-subscription.hook";
 
+/**
+ * @deprecated Use `useCurrentSubscription`, mesma leitura (mesma chave de
+ * cache, uma única requisição); só o nome muda para o vocabulário certo
+ * ("corrente", não "ativa"). Sai na 1.1.784.
+ */
 export function useActiveSubscription() {
-  const queryKey = useAuthQueryKey([...SUBSCRIPTIONS_QUERY_KEY, "active"]);
-
-  return useQuery({
-    queryKey,
-    queryFn: ({ signal }) =>
-      apiFetch<PaginatedSuccessResult<Subscription>>('/api/subscriptions', {
-        params: { limit: 1 },
-        signal,
-      }),
-    staleTime: 10_000,
-  });
+  return useCurrentSubscription();
 }

package/src/modules/subscriptions/hooks/use-current-subscription.hook.ts

@@ -0,0 +1,38 @@
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+import { apiFetch } from '../../../infra/http/api-fetch';
+import { useAuthQueryKey } from '../../../hooks/useAuthQueryKey';
+import type { PaginatedSuccessResult, SuccessResult } from '../../../infra/api/types';
+import type { Subscription } from '../types/subscription.type';
+import { SUBSCRIPTIONS_QUERY_KEY } from '../constants/query-keys.constants';
+
+/**
+ * A assinatura corrente do plano da conta, pela regra única do backend
+ * (contrato de domínio nunca é corrente; encerrada é decidida por `active`).
+ *
+ * Devolvida na mesma forma paginada de `useSubscriptions`/`useActiveSubscription`
+ * (`{ data: [sub] }`) para não exigir mudança nos call sites que já leem
+ * `data?.[0]`: só a URL e a regra por trás mudam.
+ */
+export function useCurrentSubscription() {
+  const queryKey = useAuthQueryKey([...SUBSCRIPTIONS_QUERY_KEY, 'current']);
+
+  return useQuery({
+    queryKey,
+    queryFn: async ({ signal }): Promise<PaginatedSuccessResult<Subscription>> => {
+      const result = await apiFetch<SuccessResult<Subscription | null>>(
+        '/api/subscriptions/current',
+        { signal },
+      );
+      const subscription = result.data ?? null;
+
+      return {
+        success: true,
+        data: subscription ? [subscription] : [],
+        total: subscription ? 1 : 0,
+      };
+    },
+    staleTime: 10_000,
+  });
+}

package/src/modules/subscriptions/services/subscriptions.service.ts

@@ -86,6 +86,40 @@ class SubscriptionsService {
     } satisfies PaginatedSuccessResult<Subscription>;
   }
 
+  /**
+   * A assinatura corrente do plano da conta, pela regra única do backend
+   * (`GET .../subscriptions/action/current`): contrato de domínio nunca é
+   * corrente, encerrada é decidida por `active`. Sem `id_product`, paridade
+   * com hoje (melhor rank entre todos os produtos, nunca item/domínio).
+   */
+  async getCurrentSubscription(
+    params?: { id_product?: number },
+  ): Promise<SuccessResult<Subscription | null>> {
+    const { id_account } = await getUserContext();
+
+    const query = buildQueryParams(
+      params as Record<string, string | number | undefined>,
+    );
+    const url = `/accounts/${id_account}/subscriptions/action/current${query ? `?${query}` : ""}`;
+
+    const response = await api.apps.get<ApiPaginatedActionResult<Subscription>>(url);
+
+    if (response.status === 0) {
+      throw new ApiError(
+        response.message || "Erro ao consultar assinatura corrente",
+        "GET_CURRENT_SUBSCRIPTION_FAILED",
+        400,
+      );
+    }
+
+    const raw = response.data[0];
+
+    return {
+      success: true,
+      data: raw ? SubscriptionSchema.parse(raw) : null,
+    };
+  }
+
   async calculateSubscription(
     data: CalculateSubscriptionRequest,
   ): Promise<SuccessResult<CalculateSubscriptionResponse>> {

package/src/modules/subscriptions/types/subscription.type.ts

@@ -142,4 +142,6 @@ export interface FindSubscriptionsParams {
   date_hiring_start?: string;
   date_hiring_end?: string;
   limit?: number;
+  page?: number;
+  id_product?: number;
 }

package/src/modules/subscriptions/utils/group-subscriptions-by-product.ts

@@ -0,0 +1,23 @@
+import type { Subscription } from '../types/subscription.type';
+
+/**
+ * Agrupa assinaturas por `id_product`, preservando a ordem de chegada dentro
+ * de cada grupo. Base da seção "Domínios registrados" do painel e da aba
+ * Assinatura agrupada por produto no admin.
+ */
+export function groupSubscriptionsByProduct(
+  subscriptions: Subscription[],
+): Map<number, Subscription[]> {
+  const groups = new Map<number, Subscription[]>();
+
+  for (const subscription of subscriptions) {
+    const group = groups.get(subscription.id_product);
+    if (group) {
+      group.push(subscription);
+    } else {
+      groups.set(subscription.id_product, [subscription]);
+    }
+  }
+
+  return groups;
+}

package/src/modules/subscriptions/utils/has-active-paid-subscription.ts

@@ -1,9 +1,8 @@
 import { toCalendarDate, daysBetween } from "../../../infra/utils/date";
 import { getSubscriptionCancellationState } from "./get-subscription-cancellation-state";
+import { FREE_PLAN_ID } from "../constants/subscription.constants";
 import type { Subscription } from "../types/subscription.type";
 
-const FREE_PLAN_ID = 5;
-
 type SubscriptionSnapshot = Pick<
   Subscription,
   | "type"

package/src/modules/subscriptions/utils/has-paid-subscription.ts

@@ -1,6 +1,5 @@
 import type { Subscription } from '../types/subscription.type';
-
-const FREE_PLAN_ID = 5;
+import { FREE_PLAN_ID } from '../constants/subscription.constants';
 
 type PaidSubscriptionSnapshot = Pick<Subscription, 'type' | 'id_plan' | 'charged'>;
 

package/src/modules/subscriptions/utils/read-current-subscription.ts

@@ -0,0 +1,34 @@
+import "server-only";
+
+import { cache } from "react";
+
+import { ApiError } from "../../../infra/api/types";
+import { getCurrentSubscriptionAction } from "../actions/get-current-subscription.action";
+import type { Subscription } from "../types/subscription.type";
+
+/**
+ * Leitura única por request de "qual é a assinatura corrente do plano desta
+ * conta", deduplicada via React.cache. Os quatro gates de auth
+ * (`assertAccountNotFrozen`, `assertManagementSubscription`,
+ * `assertPaidSubscription`, `assertSubscriptionAddon`) chamam esta função em
+ * vez de repetir a própria leitura cada um: eram até 4 cópias da mesma
+ * pergunta disputando a mesma fila (0,7 a 7s cada, medido em produção).
+ *
+ * Lança em falha de leitura; `assertAccountNotFrozen` é o único chamador que
+ * precisa de fail-open, e faz isso capturando o erro no próprio call site.
+ */
+export const readCurrentSubscription = cache(
+  async (): Promise<Subscription | null> => {
+    const result = await getCurrentSubscriptionAction();
+
+    if (!result.success) {
+      throw new ApiError(
+        result.error || "Não foi possível validar a assinatura atual",
+        "SUBSCRIPTION_CONTEXT_FAILED",
+        403,
+      );
+    }
+
+    return result.data?.data ?? null;
+  },
+);

package/src/modules/whitelabel/actions/find-whitelabel.action.ts

@@ -6,14 +6,7 @@ import { whitelabelService } from "../services/whitelabel.service";
 import { ApiError } from "../../../infra/api/types";
 import { cache } from "react";
 
-export const findWhitelabel = cache(async () => {
-    const headersList = await headers();
-    const host = headersList.get('host');
-
-    if (!host) {
-        throw new ApiError('Host header not found', 'HOST_NOT_FOUND', 400);
-    }
-
+const findWhitelabelByHost = cache(async (host: string) => {
     const whitelabel = await whitelabelService.getTokenByDomain(host);
 
     if (!whitelabel) {
@@ -21,4 +14,15 @@ export const findWhitelabel = cache(async () => {
     }
 
     return whitelabel;
-});
+});
+
+export const findWhitelabel = async () => {
+    const headersList = await headers();
+    const host = headersList.get('host');
+
+    if (!host) {
+        throw new ApiError('Host header not found', 'HOST_NOT_FOUND', 400);
+    }
+
+    return findWhitelabelByHost(host);
+};

package/src/modules/whitelabel/services/whitelabel.service.ts

@@ -92,17 +92,49 @@ class WhitelabelService {
     });
 
     if (cachedData.status == 1 && "data" in cachedData && cachedData.data) {
-      console.log("[WhitelabelService] Cache hit for domain", { hostname });
-      return JSON.parse(cachedData.data) as WhitelabelTokenData;
+      const cachedWhitelabel = JSON.parse(cachedData.data) as WhitelabelTokenData;
+
+      if (this.#matchesHostname(cachedWhitelabel, hostname)) {
+        console.log("[WhitelabelService] Cache hit for domain", { hostname });
+        return cachedWhitelabel;
+      }
+
+      console.error("[WhitelabelService] Cached whitelabel does not match hostname", {
+        hostname,
+        cacheKey,
+        whitelabelId: cachedWhitelabel.id,
+        whitelabelDomain: cachedWhitelabel.domain,
+      });
+
+      await cache.delete(cacheKey);
     }
 
     const data = await this.fetchFromApi(hostname);
 
+    if (!this.#matchesHostname(data, hostname)) {
+      console.error("[WhitelabelService] API returned whitelabel of another hostname", {
+        hostname,
+        whitelabelId: data.id,
+        whitelabelDomain: data.domain,
+      });
+      return data;
+    }
+
     await cache.insert(cacheKey, JSON.stringify(data), 604800);
 
     return data;
   }
 
+  #matchesHostname(data: WhitelabelTokenData, hostname: string): boolean {
+    if (!data.domain) return true;
+
+    try {
+      return normalizeHostname(new URL(data.domain).hostname) === hostname;
+    } catch {
+      return true;
+    }
+  }
+
   async getTokenByWhitelabelId(idWl: number): Promise<string> {
     const apiUrl = this.getApiUrl();
     const masterToken = this.getToken();

package/src/providers/auth.provider.tsx

@@ -46,6 +46,7 @@ import { useWhitelabelUrls, useWhitelabel } from "./whitelabel.provider";
 import { useWlQueryKey } from "../hooks/useAuthQueryKey";
 import { normalizeLocale } from "../i18n/normalize";
 import { setLocaleCookie } from "../utils/intl/locale-cookie";
+import { isSameSiteUrl } from "../utils/redirect";
 
 interface AuthContextProps extends AuthState {
   login: (credentials: LoginRequest) => Promise<LoginResult>;
@@ -200,19 +201,21 @@ export function AuthProvider({ children, publicRoutes = [] }: AuthProviderProps)
   );
 
   const resolveLogoutRedirect = useCallback(() => {
-    try {
-      const currentOrigin = window.location.origin;
-      const pagesOrigin = pagesUrl ? new URL(pagesUrl).origin : "";
+    const host = window.location.host;
 
-      if (pagesOrigin && currentOrigin === pagesOrigin) {
-        return `${accountsUrl}/login?redirect=${encodeURIComponent(pagesUrl)}`;
-      }
-    } catch {
-      // fallback below
+    if (accountsUrl && !isSameSiteUrl(accountsUrl, host)) {
+      console.error("[auth-provider] accounts_url fora do site do host atual", {
+        host,
+        whitelabelId: whitelabel?.id,
+        accountsUrl,
+      });
+      return "/login";
     }
 
-    return `${accountsUrl}/login?redirect=${encodeURIComponent(pagesUrl || "/")}`;
-  }, [accountsUrl, pagesUrl]);
+    const safePagesUrl = pagesUrl && isSameSiteUrl(pagesUrl, host) ? pagesUrl : "/";
+
+    return `${accountsUrl}/login?redirect=${encodeURIComponent(safePagesUrl)}`;
+  }, [accountsUrl, pagesUrl, whitelabel?.id]);
 
   const logout = useCallback(async (): Promise<void> => {
     try {

package/src/server.ts

@@ -28,6 +28,8 @@ export { findUserById } from './modules/users/action/find-user-by-id.action';
 export { findCurrentAccount } from './modules/accounts/actions/find-current-account.action';
 export { getAccountTokenAction } from './modules/accounts/actions/get-account-token.action';
 export { listSubscriptionsAction } from './modules/subscriptions/actions/list-subscriptions.action';
+export { getCurrentSubscriptionAction } from './modules/subscriptions/actions/get-current-subscription.action';
+export { readCurrentSubscription } from './modules/subscriptions/utils/read-current-subscription';
 export { ackFreezeNoticeAction } from './modules/subscriptions/actions/ack-freeze-notice.action';
 export { calculateSubscriptionAction } from './modules/subscriptions/actions/calculate-subscription.action';
 export { updateSubscriptionPlanAction } from './modules/subscriptions/actions/update-subscription-plan.action';

package/src/store/useMdSidebarStore.ts

@@ -1,21 +1,21 @@
 import { create } from "zustand";
+import { useEffect } from "react";
 import { readStorage, writeStorage } from "../utils/browser/safe-storage";
 
 const STORAGE_KEY = "md-sidebar-expanded";
 
-function getInitialState(): boolean {
-    return readStorage(STORAGE_KEY) === "true";
-}
-
 type MdSidebarStore = {
     isExpanded: boolean;
+    _hydrated: boolean;
     toggle: () => void;
     expand: () => void;
     collapse: () => void;
+    _hydrate: () => void;
 };
 
 export const useMdSidebarStore = create<MdSidebarStore>((set) => ({
-    isExpanded: getInitialState(),
+    isExpanded: false,
+    _hydrated: false,
     toggle: () => set((state) => {
         const next = !state.isExpanded;
         writeStorage(STORAGE_KEY, String(next));
@@ -29,4 +29,19 @@ export const useMdSidebarStore = create<MdSidebarStore>((set) => ({
         writeStorage(STORAGE_KEY, "false");
         return set({ isExpanded: false });
     },
+    _hydrate: () => {
+        const value = readStorage(STORAGE_KEY) === "true";
+        set({ isExpanded: value, _hydrated: true });
+    },
 }));
+
+export function useMdSidebarHydration() {
+    const hydrate = useMdSidebarStore((s) => s._hydrate);
+    const hydrated = useMdSidebarStore((s) => s._hydrated);
+
+    useEffect(() => {
+        if (!hydrated) {
+            hydrate();
+        }
+    }, [hydrate, hydrated]);
+}

package/src/utils/redirect.ts

@@ -36,6 +36,16 @@ export function resolveSafeRedirect(
   return url.toString();
 }
 
+export function isSameSiteUrl(target: string, currentHost: string): boolean {
+  let hostname: string;
+  try {
+    hostname = new URL(target).hostname;
+  } catch {
+    return false;
+  }
+  return isSameSite(hostname, currentHost.split(':')[0]);
+}
+
 function isSameSite(target: string, current: string): boolean {
   const host = target.toLowerCase();
   const base = baseDomain(current.toLowerCase());