@nebulr-group/bridge-svelte 0.5.1 → 0.6.0

package/dist/auth/route-guard.js

@@ -1,9 +1,22 @@
 // src/lib/auth/route-guard.ts — thin wrapper delegating to auth-core via bridge-instance
 import { getBridgeAuth } from '../core/bridge-instance.js';
-import { getRouteGuardConfig } from '../client/stores/config.store.js';
+import { getConfig, getRouteGuardConfig } from '../client/stores/config.store.js';
 export function createRouteGuard(flagsReady) {
     const config = getRouteGuardConfig();
-    const guard = getBridgeAuth().createRouteGuard(config);
+    // TBP-629 — feed the app's own loginRoute into the guard so it can refuse to
+    // make the login page its own return target. The consumer already told us
+    // where their login page is via BridgeConfig; making them repeat it under
+    // routeConfig.returnTo would be a second source of truth that can drift.
+    // An explicit routeConfig value still wins.
+    const { loginRoute } = getConfig();
+    const guardConfig = {
+        ...config,
+        returnTo: {
+            ...config?.returnTo,
+            loginRoute: config?.returnTo?.loginRoute ?? loginRoute,
+        },
+    };
+    const guard = getBridgeAuth().createRouteGuard(guardConfig);
     if (!flagsReady)
         return guard;
     // Wrap checkRouteRestrictions to await flagsReady before evaluating
@@ -13,9 +26,19 @@ export function createRouteGuard(flagsReady) {
             await flagsReady;
             return guard.checkRouteRestrictions(pathname);
         },
-        async getNavigationDecision(pathname) {
+        async getNavigationDecision(pathname, attempted) {
             if (guard.shouldRedirectToLogin(pathname)) {
-                return { type: 'login', loginUrl: guard.getLoginRedirect() };
+                // TBP-629 — this branch short-circuits before flagsReady on purpose
+                // (an unauthenticated visitor needs no flag evaluation), which is
+                // exactly why `attempted` has to be threaded through here too. The
+                // wrapper previously rebuilt the decision by hand and would silently
+                // drop any argument auth-core's version learned to accept.
+                const returnTo = guard.resolveReturnTo(attempted ?? pathname);
+                return {
+                    type: 'login',
+                    loginUrl: guard.getLoginRedirect(),
+                    ...(returnTo ? { returnTo } : {}),
+                };
             }
             await flagsReady;
             const redirectTo = await guard.checkRouteRestrictions(pathname);

package/dist/client/BridgeBootstrap.js

@@ -4,9 +4,9 @@ import { get } from 'svelte/store';
 import { createRouteGuard } from '../auth/route-guard.js';
 import { getBridgeAuth, bridgeReadyStore, markReady, waitForBridge as _waitForBridge, } from '../core/bridge-instance.js';
 import { installBridgeAuthFetch } from '../core/bridge-runtime.js';
-import { useBridge } from '@nebulr-group/bridge-auth-core';
+import { useBridge, stashReturnTo, takeReturnTo, withReturnTo } from '@nebulr-group/bridge-auth-core';
 import { logger } from '../shared/logger.js';
-import { bridgeConfig, getConfig } from './stores/config.store.js';
+import { bridgeConfig, getConfig, getRouteGuardConfig } from './stores/config.store.js';
 export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }, kitFetch) {
     // If we've already completed bootstrap once, short-circuit
     if (get(bridgeReadyStore)) {
@@ -58,7 +58,17 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
                         history.replaceState = svelteReplaceState;
                     }
                     const payment = url.searchParams.get('payment');
-                    redirect(303, payment ? `/?payment=${payment}` : '/');
+                    // TBP-629 — this line used to hard-code '/', which is where hosted
+                    // mode lost the deep link even though the OAuth round-trip itself
+                    // worked fine. `takeReturnTo()` is one-shot and re-sanitizes, and
+                    // returns null when nothing was stashed, so the old behaviour is
+                    // exactly what happens when there is no deep link to restore.
+                    //
+                    // `payment` wins: it signals a just-completed checkout whose landing
+                    // page the billing flow owns, and that is a deliberate destination
+                    // rather than a remembered one.
+                    const stashedReturnTo = takeReturnTo();
+                    redirect(303, payment ? `/?payment=${payment}` : (stashedReturnTo ?? '/'));
                 }
                 catch (err) {
                     if (isRedirect(err))
@@ -170,13 +180,33 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
         hasTokens: !!currentTokens?.accessToken,
         isAuthenticated: currentAuth
     });
-    const decision = await guard.getNavigationDecision(url.pathname);
+    // TBP-629 — hand the guard the FULL attempted target, not just the pathname.
+    // `?key=…` style query is part of the deep link for plenty of routes, and an
+    // exported-file link that loses its query is as broken as one that loses its
+    // path.
+    const attempted = `${url.pathname}${url.search}`;
+    const decision = await guard.getNavigationDecision(url.pathname, attempted);
     logger.debug('[bridgeBootstrap] navigation decision', decision);
     if (decision.type === 'login') {
         const { loginRoute } = getConfig();
+        const returnToParam = getRouteGuardConfig()?.returnTo?.param;
         // SDK mode: consumer explicitly set loginRoute → redirect to in-app login view
         // Hosted mode (default): no loginRoute → redirect to hosted auth portal
-        redirect(303, loginRoute ?? bridge.createLoginUrl());
+        //
+        // TBP-629: only SDK mode gains the return target. Hosted mode is left exactly
+        // as it was — `createLoginUrl()` already carries its own `redirectUri` (the
+        // configured callbackUrl) and changing what that means would alter an OAuth
+        // round-trip that consumers have registered redirect URIs against.
+        if (loginRoute) {
+            redirect(303, withReturnTo(loginRoute, decision.returnTo, returnToParam));
+        }
+        // Hosted mode (TBP-629): the target CANNOT ride on the URL. `createLoginUrl()`
+        // feeds `redirectUri` to the OAuth authorize call and bridge-api validates it
+        // with an exact `allowedRedirectUris.includes()` match, so adding a query to
+        // it would break login rather than improve it. Stash it instead and pick it
+        // up at the callback below — the OAuth request itself stays untouched.
+        stashReturnTo(decision.returnTo);
+        redirect(303, bridge.createLoginUrl());
     }
     if (decision.type === 'redirect' && url.pathname !== decision.to) {
         redirect(303, decision.to);

package/dist/client/BridgeBootstrap.svelte

@@ -3,6 +3,7 @@
   import { page } from '$app/stores';
   import { onMount, onDestroy } from 'svelte';
   import { createRouteGuard, routeRulesReferenceFlag } from '../auth/route-guard.js';
+  import { stashReturnTo, withReturnTo } from '@nebulr-group/bridge-auth-core';
   import {
     getBridgeAuth,
     isAuthenticated,
@@ -12,7 +13,7 @@
   } from '../core/bridge-instance.js';
   import { bridge as bridgeSurface } from '../core/bridge.js';
   import { setBridgeContext } from '../core/use-bridge.js';
-  import { getConfig } from './stores/config.store.js';
+  import { getConfig, getRouteGuardConfig } from './stores/config.store.js';
   import {
     onBridgeFlagChange,
     startBridgeRuntime,
@@ -73,14 +74,24 @@
     }
   });
 
-  async function handleRoute(pathname: string, cancel?: () => void) {
-    const decision = await guard.getNavigationDecision(pathname);
+  async function handleRoute(pathname: string, cancel?: () => void, search?: string) {
+    // TBP-629 — client-side navigation loses the deep link the same way the
+    // load-time path did. Fixing only BridgeBootstrap.ts would leave somebody
+    // who clicks an in-app link into a protected route while their session is
+    // gone landing on the default route, which is the same bug with a different
+    // trigger.
+    const attempted = `${pathname}${search ?? ''}`;
+    const decision = await guard.getNavigationDecision(pathname, attempted);
     if (decision.type === 'login') {
       if (cancel) cancel();
       const { loginRoute } = getConfig();
       if (loginRoute) {
-        goto(loginRoute);
+        goto(withReturnTo(loginRoute, decision.returnTo, getRouteGuardConfig()?.returnTo?.param));
       } else {
+        // Hosted mode (TBP-629) — stash before handing off to the portal; the
+        // callback in BridgeBootstrap.ts picks it up. Same reason as there: the
+        // OAuth redirectUri is exact-matched server-side and must not be touched.
+        stashReturnTo(decision.returnTo);
         getBridgeAuth().login();
       }
       return;
@@ -110,7 +121,7 @@
       _recheckTimer = undefined;
       // No `cancel` here: there is no navigation in flight to cancel. A denied
       // verdict redirects the user off the page they are already on.
-      handleRoute(window.location.pathname).catch(() => {
+      handleRoute(window.location.pathname, undefined, window.location.search).catch(() => {
         /* a failed re-check must never break the page; the next navigation
            re-evaluates anyway */
       });
@@ -180,6 +191,6 @@
 
   beforeNavigate(async ({ to, cancel }) => {
     if (!to) return;
-    await handleRoute(to.url.pathname, cancel);
+    await handleRoute(to.url.pathname, cancel, to.url.search);
   });
 </script>

package/dist/client/components/sdk-auth/ForgotPassword.svelte

@@ -1,6 +1,8 @@
 <script lang="ts">
   import type { HTMLAttributes } from 'svelte/elements';
+  import type { MessageOverrides } from '@nebulr-group/bridge-auth-core';
   import { getBridgeAuth } from '../../../core/bridge-instance.js';
+  import { getTranslator } from '../../stores/i18n.js';
   import AuthFormWrapper from './shared/AuthFormWrapper.svelte';
   import Spinner from './shared/Spinner.svelte';
   import Alert from './shared/Alert.svelte';
@@ -15,6 +17,14 @@
      * Pass `null`/`''` to render no heading and use your own page title.
      */
     heading?: string | null;
+    /**
+     * Step description. Pass `null`/`''` to render nothing and use your own
+     * subtitle (TBP-631). Only ever shown on the send-link step; the set-password
+     * and success states carry none.
+     */
+    description?: string | null;
+    /** Per-key copy overrides for this component only (TBP-630). */
+    messages?: MessageOverrides;
   }
 
   let {
@@ -23,11 +33,15 @@
     onError,
     loginHref = '/login',
     heading = undefined,
+    description = undefined,
+    messages,
     class: className,
     style,
     ...rest
   }: Props = $props();
 
+  const t = $derived(getTranslator(messages));
+
   let email = $state('');
   let password = $state('');
   let confirmPassword = $state('');
@@ -42,11 +56,25 @@
   // In a success state ("Password set" / the email-sent alert) the form heading
   // is redundant, so suppress it. Otherwise use the override (if provided) or
   // the built-in, state-appropriate heading.
-  const builtInHeading = $derived(isSetMode ? 'Set new password' : 'Reset your password');
+  const builtInHeading = $derived(
+    isSetMode ? t('forgot.headingSet') : t('forgot.headingRequest'),
+  );
   const wrapperHeading = $derived(
     passwordReset || emailSent ? null : heading !== undefined ? heading : builtInHeading,
   );
 
+  // TBP-631 — same shape as the heading above: the description belongs to the
+  // send-link step only. `undefined` means "not overridden" and falls through to
+  // the built-in; `null` is an explicit suppression from the host and must be
+  // respected, which is why this cannot collapse to `description ?? builtIn`.
+  const wrapperDescription = $derived(
+    isSetMode || passwordReset || emailSent
+      ? null
+      : description !== undefined
+        ? description
+        : t('forgot.description'),
+  );
+
   async function handleSendLink() {
     if (loading) return;
     error = null;
@@ -55,7 +83,7 @@
       await getBridgeAuth().sendResetPasswordLink(email);
       emailSent = true;
     } catch (err: any) {
-      error = err.message || 'Failed to send reset link.';
+      error = err.message || t('forgot.error.send');
       onError?.(err);
     } finally {
       loading = false;
@@ -67,12 +95,12 @@
     error = null;
 
     if (password !== confirmPassword) {
-      error = 'Passwords do not match.';
+      error = t('forgot.error.mismatch');
       return;
     }
 
     if (password.length < 8) {
-      error = 'Password must be at least 8 characters.';
+      error = t('forgot.error.tooShort');
       return;
     }
 
@@ -82,7 +110,7 @@
       passwordReset = true;
       onComplete?.();
     } catch (err: any) {
-      error = err.message || 'Failed to update password.';
+      error = err.message || t('forgot.error.update');
       onError?.(err);
     } finally {
       loading = false;
@@ -92,6 +120,7 @@
 
 <AuthFormWrapper
   heading={wrapperHeading}
+  description={wrapperDescription}
   class={className}
   {style}
   {...rest}
@@ -102,19 +131,19 @@
 
   {#if isSetMode}
     {#if passwordReset}
-      <h2 class="bridge-success-heading">Password set</h2>
+      <h2 class="bridge-success-heading">{t('forgot.successHeading')}</h2>
       <div class="bridge-form-footer">
-        <a href={loginHref}>Back to login</a>
+        <a href={loginHref}>{t('action.backToLogin')}</a>
       </div>
     {:else}
       <form onsubmit={(e) => { e.preventDefault(); handleSetPassword(); }}>
         <div class="bridge-form-group">
-          <label for="newPassword">New password</label>
+          <label for="newPassword">{t('field.newPassword')}</label>
           <div class="bridge-password-wrapper">
             <input
               id="newPassword"
               type={showPasswords ? 'text' : 'password'}
-              placeholder="At least 8 characters"
+              placeholder={t('placeholder.newPassword')}
               required
               bind:value={password}
               disabled={loading}
@@ -124,7 +153,7 @@
               class="bridge-password-toggle"
               onclick={() => showPasswords = !showPasswords}
               tabindex={-1}
-              aria-label={showPasswords ? 'Hide passwords' : 'Show passwords'}
+              aria-label={showPasswords ? t('action.hidePasswords') : t('action.showPasswords')}
             >
               {#if showPasswords}
                 <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94"/><path d="M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19"/><line x1="1" y1="1" x2="23" y2="23"/></svg>
@@ -135,12 +164,12 @@
           </div>
         </div>
         <div class="bridge-form-group">
-          <label for="confirmPassword">Confirm password</label>
+          <label for="confirmPassword">{t('field.confirmPassword')}</label>
           <div class="bridge-password-wrapper">
             <input
               id="confirmPassword"
               type={showPasswords ? 'text' : 'password'}
-              placeholder="Repeat password"
+              placeholder={t('placeholder.confirmPassword')}
               required
               bind:value={confirmPassword}
               disabled={loading}
@@ -148,36 +177,35 @@
           </div>
         </div>
         <button type="submit" class="bridge-btn bridge-btn-primary" disabled={loading || !password}>
-          {#if loading}<Spinner size={16} />{:else}Set a password{/if}
+          {#if loading}<Spinner size={16} />{:else}{t('forgot.setSubmit')}{/if}
         </button>
       </form>
     {/if}
   {:else}
     {#if emailSent}
-      <Alert variant="success">Check your email for a password reset link.</Alert>
+      <Alert variant="success">{t('forgot.emailSent')}</Alert>
       <div class="bridge-form-footer">
-        <a href={loginHref}>Back to login</a>
+        <a href={loginHref}>{t('action.backToLogin')}</a>
       </div>
     {:else}
-      <p class="bridge-step-desc">Enter your email and we'll send you a link to reset your password.</p>
       <form onsubmit={(e) => { e.preventDefault(); handleSendLink(); }}>
         <div class="bridge-form-group">
-          <label for="reset-email">Email</label>
+          <label for="reset-email">{t('field.email')}</label>
           <input
             id="reset-email"
             type="email"
-            placeholder="you@example.com"
+            placeholder={t('placeholder.email')}
             required
             bind:value={email}
             disabled={loading}
           />
         </div>
         <button type="submit" class="bridge-btn bridge-btn-primary" disabled={loading || !email.trim()}>
-          {#if loading}<Spinner size={16} />{:else}Send reset link{/if}
+          {#if loading}<Spinner size={16} />{:else}{t('forgot.submit')}{/if}
         </button>
       </form>
       <div class="bridge-form-footer">
-        <a href={loginHref}>Back to login</a>
+        <a href={loginHref}>{t('action.backToLogin')}</a>
       </div>
     {/if}
   {/if}

package/dist/client/components/sdk-auth/ForgotPassword.svelte.d.ts

@@ -1,4 +1,5 @@
 import type { HTMLAttributes } from 'svelte/elements';
+import type { MessageOverrides } from '@nebulr-group/bridge-auth-core';
 interface Props extends HTMLAttributes<HTMLDivElement> {
     token?: string;
     onComplete?: () => void;
@@ -9,6 +10,14 @@ interface Props extends HTMLAttributes<HTMLDivElement> {
      * Pass `null`/`''` to render no heading and use your own page title.
      */
     heading?: string | null;
+    /**
+     * Step description. Pass `null`/`''` to render nothing and use your own
+     * subtitle (TBP-631). Only ever shown on the send-link step; the set-password
+     * and success states carry none.
+     */
+    description?: string | null;
+    /** Per-key copy overrides for this component only (TBP-630). */
+    messages?: MessageOverrides;
 }
 declare const ForgotPassword: import("svelte").Component<Props, {}, "">;
 type ForgotPassword = ReturnType<typeof ForgotPassword>;