@salesforce/templates 66.14.0 → 66.16.0

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/pages/AccountObjectDetailPage.tsx

@@ -6,7 +6,7 @@ import GET_ACCOUNT_DETAIL from "../api/account/query/getAccountDetail.graphql?ra
 import { Alert, AlertTitle, AlertDescription } from "../components/ui/alert";
 import { Button } from "../components/ui/button";
 import { Card, CardContent } from "../components/ui/card";
-import { fieldValue, getAddressFieldLines, formatDateTimeField } from "../utils/accountFields";
+import { fieldValue, getAddressFieldLines } from "../utils/accountFields";
 import {
 	Collapsible,
 	CollapsibleTrigger,
@@ -15,13 +15,8 @@ import {
 import { Separator } from "../components/ui/separator";
 import { Skeleton } from "../components/ui/skeleton";
 import { useAsyncData } from "../hooks/useAsyncData";
-import { ObjectBreadcrumb } from "../components/ObjectBreadcrumb";
 
-/**
- * A uiapi scalar field as returned with `@optional { value displayValue }`.
- * Typed locally so this page no longer depends on the generated
- * `graphql-operations-types` that shipped with feature-react-object-search.
- */
+/** A uiapi scalar field as returned with `@optional { value displayValue }`. Typed locally to avoid a generated-types dependency. */
 type FieldValue = { value?: unknown; displayValue?: string | null } | null;
 type NameHolder = { Name?: FieldValue } | null;
 
@@ -88,23 +83,17 @@ export default function AccountObjectDetail() {
 		error,
 	} = useAsyncData(() => fetchAccountDetail(recordId!), [recordId]);
 
-	return (
-		<div className="max-w-6xl mx-auto px-4 sm:px-6 lg:px-8 py-6">
-			<ObjectBreadcrumb
-				listPath="/accounts"
-				listLabel="Accounts"
-				loading={loading}
-				recordName={
-					account
-						? (fieldValue(account.Name) ?? "")
-						: error
-							? "Error"
-							: loading
-								? undefined
-								: "Not Found"
-				}
-			/>
+	const pageTitle = account
+		? `${fieldValue(account.Name) ?? "Account"} | MyApp`
+		: error
+			? "Error | MyApp"
+			: loading
+				? "Loading Account | MyApp"
+				: "Account Not Found | MyApp";
 
+	return (
+		<main className="max-w-6xl mx-auto px-4 sm:px-6 lg:px-8 py-6">
+			<title>{pageTitle}</title>
 			{/* Loading state */}
 			{loading && <AccountDetailSkeleton />}
 
@@ -116,7 +105,7 @@ export default function AccountObjectDetail() {
 
 			{/* Content */}
 			{account && <AccountDetailContent account={account} />}
-		</div>
+		</main>
 	);
 }
 
@@ -137,17 +126,8 @@ function AccountDetailContent({ account }: { account: AccountNode }) {
 		country: fieldValue(account.ShippingCountry),
 	});
 
-	const dateTimeOptions = { dateStyle: "medium", timeStyle: "short" } as const;
-	const createdDate = formatDateTimeField(
-		fieldValue(account.CreatedDate),
-		undefined,
-		dateTimeOptions,
-	);
-	const lastModifiedDate = formatDateTimeField(
-		fieldValue(account.LastModifiedDate),
-		undefined,
-		dateTimeOptions,
-	);
+	const createdDate = fieldValue(account.CreatedDate);
+	const lastModifiedDate = fieldValue(account.LastModifiedDate);
 
 	return (
 		<>
@@ -258,10 +238,16 @@ function Section({ title, children }: { title: string; children: React.ReactNode
 	const [open, setOpen] = useState(true);
 	return (
 		<Collapsible open={open} onOpenChange={setOpen}>
-			<CollapsibleTrigger className="flex items-center gap-2 cursor-pointer text-lg font-semibold py-2">
-				{open ? <ChevronDown className="size-5" /> : <ChevronRight className="size-5" />}
-				{title}
-			</CollapsibleTrigger>
+			<h2>
+				<CollapsibleTrigger className="flex items-center gap-2 cursor-pointer text-lg font-semibold py-2">
+					{open ? (
+						<ChevronDown aria-hidden="true" className="size-5" />
+					) : (
+						<ChevronRight aria-hidden="true" className="size-5" />
+					)}
+					{title}
+				</CollapsibleTrigger>
+			</h2>
 			<CollapsibleContent>
 				<div className="mt-2 space-y-4">{children}</div>
 			</CollapsibleContent>
@@ -273,9 +259,9 @@ function AccountDetailError({ onBack }: { onBack: () => void }) {
 	return (
 		<>
 			<Alert variant="destructive" role="alert">
-				<AlertCircle />
+				<AlertCircle aria-hidden="true" />
 				<AlertTitle>
-					<h2>Failed to load account</h2>
+					<h1>Failed to load account</h1>
 				</AlertTitle>
 				<AlertDescription>
 					Something went wrong while loading this account. Please try again later.
@@ -283,7 +269,7 @@ function AccountDetailError({ onBack }: { onBack: () => void }) {
 			</Alert>
 			<div className="mt-4 flex gap-3">
 				<Button variant="outline" onClick={onBack}>
-					← Back
+					<span aria-hidden="true">←</span> Back
 				</Button>
 				<Button variant="outline" onClick={() => window.location.reload()}>
 					Retry
@@ -297,13 +283,13 @@ function AccountDetailNotFound({ onBack }: { onBack: () => void }) {
 	return (
 		<Card>
 			<CardContent className="flex flex-col items-center justify-center py-16 text-center">
-				<FileQuestion className="size-12 text-muted-foreground mb-4" />
-				<h2 className="text-lg font-semibold mb-1">Account not found</h2>
+				<FileQuestion aria-hidden="true" className="size-12 text-muted-foreground mb-4" />
+				<h1 className="text-lg font-semibold mb-1">Account not found</h1>
 				<p className="text-sm text-muted-foreground mb-6">
 					The account you're looking for doesn't exist or may have been deleted.
 				</p>
 				<Button variant="outline" onClick={onBack}>
-					← Go back
+					<span aria-hidden="true">←</span> Go back
 				</Button>
 			</CardContent>
 		</Card>
@@ -312,7 +298,8 @@ function AccountDetailNotFound({ onBack }: { onBack: () => void }) {
 
 function AccountDetailSkeleton() {
 	return (
-		<>
+		<div role="status" aria-live="polite">
+			<span className="sr-only">Loading account…</span>
 			<Skeleton className="h-8 w-56 mb-4" />
 
 			<Card>
@@ -361,7 +348,7 @@ function AccountDetailSkeleton() {
 					</div>
 				</CardContent>
 			</Card>
-		</>
+		</div>
 	);
 }
 

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/pages/Home.tsx

@@ -2,9 +2,10 @@ import { GlobalSearchBox } from "../features/search";
 
 export default function HomePage() {
 	return (
-		<div className="max-w-2xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
+		<main className="max-w-2xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
+			<title>Home | MyApp</title>
 			<h1 className="text-2xl font-bold mb-6">Home</h1>
 			<GlobalSearchBox placeholder="Search accounts, contacts, opportunities..." />
-		</div>
+		</main>
 	);
 }

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/utils/accountFields.ts

@@ -1,8 +1,4 @@
-/**
- * Field helpers for reading uiapi GraphQL response nodes on the Account
- * detail page. Previously imported from feature-react-object-search; inlined
- * here so the app no longer depends on that feature.
- */
+/** Field helpers for reading uiapi GraphQL response nodes: values arrive as `{ value, displayValue }` objects, so callers need one place to unwrap them. */
 
 /** Picks the user-facing string for a `{ value, displayValue }` field. */
 export function fieldValue(
@@ -27,12 +23,3 @@ export function getAddressFieldLines(address: {
 	if (lines.length === 0) return null;
 	return lines;
 }
-
-/** Formats an ISO datetime string with `toLocaleString`, or null if absent. */
-export function formatDateTimeField(
-	value?: string | null,
-	...args: Parameters<Date["toLocaleString"]>
-) {
-	if (!value) return null;
-	return new Date(value).toLocaleString(...args);
-}

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/app.tsx","./src/appLayout.tsx","./src/index.ts","./src/navigationMenu.tsx","./src/router-utils.tsx","./src/routes.tsx","./src/api/graphqlClient.ts","./src/components/CustomerWebClientChat.tsx","./src/components/ObjectBreadcrumb.tsx","./src/components/alerts/status-alert.tsx","./src/components/layouts/card-layout.tsx","./src/components/ui/alert.tsx","./src/components/ui/avatar.tsx","./src/components/ui/badge.tsx","./src/components/ui/breadcrumb.tsx","./src/components/ui/button.tsx","./src/components/ui/calendar.tsx","./src/components/ui/card.tsx","./src/components/ui/checkbox.tsx","./src/components/ui/collapsible.tsx","./src/components/ui/datePicker.tsx","./src/components/ui/dialog.tsx","./src/components/ui/dropdown-menu.tsx","./src/components/ui/field.tsx","./src/components/ui/index.ts","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/pagination.tsx","./src/components/ui/popover.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/skeleton.tsx","./src/components/ui/sonner.tsx","./src/components/ui/spinner.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/features/authentication/authHelpers.ts","./src/features/authentication/authenticationConfig.ts","./src/features/authentication/api/userProfileApi.ts","./src/features/authentication/components/SocialLogin.tsx","./src/features/authentication/context/AuthContext.tsx","./src/features/authentication/footers/footer-link.tsx","./src/features/authentication/forms/auth-form.tsx","./src/features/authentication/forms/submit-button.tsx","./src/features/authentication/hooks/form.tsx","./src/features/authentication/hooks/useCountdownTimer.ts","./src/features/authentication/hooks/useRetryWithBackoff.ts","./src/features/authentication/layout/centered-page-layout.tsx","./src/features/authentication/layouts/AuthAppLayout.tsx","./src/features/authentication/layouts/privateRouteLayout.tsx","./src/features/authentication/menu/AuthMenu.tsx","./src/features/authentication/pages/ChangePassword.tsx","./src/features/authentication/pages/ForgotPassword.tsx","./src/features/authentication/pages/Login.tsx","./src/features/authentication/pages/Profile.tsx","./src/features/authentication/pages/Register.tsx","./src/features/authentication/pages/ResetPassword.tsx","./src/features/authentication/sessionTimeout/SessionTimeoutValidator.tsx","./src/features/authentication/sessionTimeout/sessionTimeService.ts","./src/features/authentication/sessionTimeout/sessionTimeoutConfig.ts","./src/features/authentication/utils/helpers.ts","./src/features/language-switcher/LanguageSwitcher.tsx","./src/features/language-switcher/buildLanguageUrl.ts","./src/features/language-switcher/index.ts","./src/features/language-switcher/languages.ts","./src/features/language-switcher/__examples__/language-switcher-example.tsx","./src/features/language-switcher/__examples__/vite-config-site-example.ts","./src/features/search/constants.ts","./src/features/search/index.ts","./src/features/search/loadConfig.ts","./src/features/search/queryBuilder.ts","./src/features/search/types.ts","./src/features/search/__tests__/queryBuilder.test.ts","./src/features/search/adapters/registry.ts","./src/features/search/adapters/types.ts","./src/features/search/adapters/cms/channelResolver.ts","./src/features/search/adapters/cms/cmsQueryFragment.ts","./src/features/search/adapters/cms/contentTypeSessionCache.ts","./src/features/search/adapters/cms/contentTypeUtils.ts","./src/features/search/adapters/cms/index.ts","./src/features/search/adapters/cms/parseResponse.ts","./src/features/search/adapters/cms/searchChannel.ts","./src/features/search/adapters/cms/types.ts","./src/features/search/adapters/cms/__tests__/channelResolver.test.ts","./src/features/search/adapters/cms/__tests__/cmsQueryFragment.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeSessionCache.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeUtils.test.ts","./src/features/search/adapters/cms/__tests__/orgApiVersionService.test.ts","./src/features/search/adapters/cms/__tests__/parseResponse.test.ts","./src/features/search/adapters/cms/__tests__/searchChannel.test.ts","./src/features/search/adapters/cms/__tests__/searchableContentTypesService.test.ts","./src/features/search/adapters/cms/api/apiUtils.ts","./src/features/search/adapters/cms/api/orgApiVersionService.ts","./src/features/search/adapters/cms/api/searchableContentTypesService.ts","./src/features/search/adapters/cms/hooks/useSearchableContentTypes.ts","./src/features/search/adapters/sobject/index.ts","./src/features/search/adapters/sobject/parseResponse.ts","./src/features/search/adapters/sobject/queryFragment.ts","./src/features/search/api/distinctValuesService.ts","./src/features/search/api/searchService.ts","./src/features/search/api/__tests__/searchService.test.ts","./src/features/search/components/GlobalSearchBox.tsx","./src/features/search/components/MergedSearchResults.tsx","./src/features/search/components/Search.tsx","./src/features/search/components/SearchResults.tsx","./src/features/search/components/SourceSection.tsx","./src/features/search/components/__tests__/Search.test.tsx","./src/features/search/components/controls/PaginationControls.tsx","./src/features/search/components/controls/ScopeSelector.tsx","./src/features/search/components/controls/SearchBar.tsx","./src/features/search/components/controls/SortControl.tsx","./src/features/search/components/filters/ActiveFilters.tsx","./src/features/search/components/filters/DefaultFilterPanel.tsx","./src/features/search/components/filters/FilterContext.tsx","./src/features/search/components/filters/inputs/BooleanFilter.tsx","./src/features/search/components/filters/inputs/DateRangeFilter.tsx","./src/features/search/components/filters/inputs/FilterFieldWrapper.tsx","./src/features/search/components/filters/inputs/MultiSelectFilter.tsx","./src/features/search/components/filters/inputs/NumericRangeFilter.tsx","./src/features/search/components/filters/inputs/SelectFilter.tsx","./src/features/search/components/filters/inputs/TextFilter.tsx","./src/features/search/components/results/CmsResultRow.tsx","./src/features/search/components/results/DefaultResultRow.tsx","./src/features/search/components/results/resolveResultRenderer.ts","./src/features/search/components/results/__tests__/CmsResultRow.test.tsx","./src/features/search/components/results/__tests__/resolveResultRenderer.test.ts","./src/features/search/hooks/useAsyncData.ts","./src/features/search/hooks/useDistinctValues.ts","./src/features/search/hooks/useSearch.ts","./src/features/search/utils/debounce.ts","./src/features/search/utils/fieldUtils.ts","./src/features/search/utils/filterUtils.ts","./src/features/search/utils/sortUtils.ts","./src/hooks/useAsyncData.ts","./src/lib/utils.ts","./src/pages/AccountObjectDetailPage.tsx","./src/pages/Home.tsx","./src/pages/NotFound.tsx","./src/pages/TestChatPage.tsx","./src/types/chat.ts","./src/types/globals.d.ts","./src/utils/accountFields.ts","./e2e/app.spec.ts","./vite-env.d.ts","./vitest-env.d.ts","./vitest.setup.ts","../../../../../../../../../sdk/platform-sdk/types/env.d.ts"],"version":"5.9.3"}
+{"root":["./src/app.tsx","./src/appLayout.tsx","./src/index.ts","./src/navigationMenu.tsx","./src/router-utils.tsx","./src/routes.tsx","./src/api/graphqlClient.ts","./src/components/CustomerWebClientChat.tsx","./src/components/ObjectBreadcrumb.tsx","./src/components/alerts/status-alert.tsx","./src/components/layouts/card-layout.tsx","./src/components/ui/alert.tsx","./src/components/ui/avatar.tsx","./src/components/ui/badge.tsx","./src/components/ui/breadcrumb.tsx","./src/components/ui/button.tsx","./src/components/ui/calendar.tsx","./src/components/ui/card.tsx","./src/components/ui/checkbox.tsx","./src/components/ui/collapsible.tsx","./src/components/ui/datePicker.tsx","./src/components/ui/dialog.tsx","./src/components/ui/dropdown-menu.tsx","./src/components/ui/field.tsx","./src/components/ui/index.ts","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/pagination.tsx","./src/components/ui/popover.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/skeleton.tsx","./src/components/ui/sonner.tsx","./src/components/ui/spinner.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/features/authentication/authHelpers.ts","./src/features/authentication/authenticationConfig.ts","./src/features/authentication/api/userProfileApi.ts","./src/features/authentication/components/SocialLogin.tsx","./src/features/authentication/context/AuthContext.tsx","./src/features/authentication/footers/footer-link.tsx","./src/features/authentication/forms/auth-form.tsx","./src/features/authentication/forms/submit-button.tsx","./src/features/authentication/hooks/form.tsx","./src/features/authentication/hooks/useCountdownTimer.ts","./src/features/authentication/hooks/useRetryWithBackoff.ts","./src/features/authentication/layout/centered-page-layout.tsx","./src/features/authentication/layouts/AuthAppLayout.tsx","./src/features/authentication/layouts/privateRouteLayout.tsx","./src/features/authentication/menu/AuthMenu.tsx","./src/features/authentication/pages/ChangePassword.tsx","./src/features/authentication/pages/ForgotPassword.tsx","./src/features/authentication/pages/Login.tsx","./src/features/authentication/pages/Profile.tsx","./src/features/authentication/pages/Register.tsx","./src/features/authentication/pages/ResetPassword.tsx","./src/features/authentication/sessionTimeout/SessionTimeoutValidator.tsx","./src/features/authentication/sessionTimeout/sessionTimeService.ts","./src/features/authentication/sessionTimeout/sessionTimeoutConfig.ts","./src/features/authentication/utils/helpers.ts","./src/features/language-switcher/LanguageSwitcher.tsx","./src/features/language-switcher/buildLanguageUrl.ts","./src/features/language-switcher/index.ts","./src/features/language-switcher/languages.ts","./src/features/language-switcher/__examples__/language-switcher-example.tsx","./src/features/language-switcher/__examples__/vite-config-site-example.ts","./src/features/search/constants.ts","./src/features/search/index.ts","./src/features/search/loadConfig.ts","./src/features/search/queryBuilder.ts","./src/features/search/types.ts","./src/features/search/__tests__/queryBuilder.test.ts","./src/features/search/adapters/registry.ts","./src/features/search/adapters/types.ts","./src/features/search/adapters/cms/channelResolver.ts","./src/features/search/adapters/cms/cmsQueryFragment.ts","./src/features/search/adapters/cms/contentTypeSessionCache.ts","./src/features/search/adapters/cms/contentTypeUtils.ts","./src/features/search/adapters/cms/index.ts","./src/features/search/adapters/cms/parseResponse.ts","./src/features/search/adapters/cms/searchChannel.ts","./src/features/search/adapters/cms/types.ts","./src/features/search/adapters/cms/__tests__/channelResolver.test.ts","./src/features/search/adapters/cms/__tests__/cmsQueryFragment.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeSessionCache.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeUtils.test.ts","./src/features/search/adapters/cms/__tests__/orgApiVersionService.test.ts","./src/features/search/adapters/cms/__tests__/parseResponse.test.ts","./src/features/search/adapters/cms/__tests__/searchChannel.test.ts","./src/features/search/adapters/cms/__tests__/searchableContentTypesService.test.ts","./src/features/search/adapters/cms/api/apiUtils.ts","./src/features/search/adapters/cms/api/orgApiVersionService.ts","./src/features/search/adapters/cms/api/searchableContentTypesService.ts","./src/features/search/adapters/cms/hooks/useSearchableContentTypes.ts","./src/features/search/adapters/sobject/index.ts","./src/features/search/adapters/sobject/parseResponse.ts","./src/features/search/adapters/sobject/queryFragment.ts","./src/features/search/api/distinctValuesService.ts","./src/features/search/api/searchService.ts","./src/features/search/api/__tests__/searchService.test.ts","./src/features/search/components/GlobalSearchBox.tsx","./src/features/search/components/MergedSearchResults.tsx","./src/features/search/components/Search.tsx","./src/features/search/components/SearchResults.tsx","./src/features/search/components/SourceSection.tsx","./src/features/search/components/__tests__/MergedSearchResults.test.tsx","./src/features/search/components/__tests__/Search.test.tsx","./src/features/search/components/__tests__/SourceSection.test.tsx","./src/features/search/components/controls/PaginationControls.tsx","./src/features/search/components/controls/ScopeSelector.tsx","./src/features/search/components/controls/SearchBar.tsx","./src/features/search/components/controls/SortControl.tsx","./src/features/search/components/filters/ActiveFilters.tsx","./src/features/search/components/filters/DefaultFilterPanel.tsx","./src/features/search/components/filters/FilterContext.tsx","./src/features/search/components/filters/inputs/BooleanFilter.tsx","./src/features/search/components/filters/inputs/DateRangeFilter.tsx","./src/features/search/components/filters/inputs/FilterFieldWrapper.tsx","./src/features/search/components/filters/inputs/MultiSelectFilter.tsx","./src/features/search/components/filters/inputs/NumericRangeFilter.tsx","./src/features/search/components/filters/inputs/SelectFilter.tsx","./src/features/search/components/filters/inputs/TextFilter.tsx","./src/features/search/components/results/CmsResultRow.tsx","./src/features/search/components/results/DefaultResultRow.tsx","./src/features/search/components/results/resolveResultRenderer.ts","./src/features/search/components/results/__tests__/CmsResultRow.test.tsx","./src/features/search/components/results/__tests__/resolveResultRenderer.test.ts","./src/features/search/hooks/useAsyncData.ts","./src/features/search/hooks/useDistinctValues.ts","./src/features/search/hooks/useSearch.ts","./src/features/search/utils/debounce.ts","./src/features/search/utils/fieldUtils.ts","./src/features/search/utils/filterUtils.ts","./src/features/search/utils/sortUtils.ts","./src/features/search/utils/__tests__/filterUtils.test.ts","./src/hooks/useAsyncData.ts","./src/lib/utils.ts","./src/pages/AccountObjectDetailPage.tsx","./src/pages/Home.tsx","./src/pages/NotFound.tsx","./src/pages/TestChatPage.tsx","./src/types/chat.ts","./src/types/globals.d.ts","./src/utils/accountFields.ts","./src/utils/__tests__/accountFields.test.ts","./e2e/app.spec.ts","./vite-env.d.ts","./vitest-env.d.ts","./vitest.setup.ts","../../../../../../../../../sdk/platform-sdk/types/env.d.ts"],"version":"5.9.3"}

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleAuthUtils_Test.cls

@@ -0,0 +1,141 @@
+/**
+ * Test class for UIBundleAuthUtils.
+ *
+ * Focuses on getSanitizedStartUrl, the shared open-redirect (CWE-601) guard
+ * used by UIBundleLogin, UIBundleRegistration and UIBundleSocialLoginConfig.
+ * Every rejection path and the safe-path prefixing
+ * behavior are asserted deterministically with an explicit path prefix.
+ */
+@isTest
+private class UIBundleAuthUtils_Test {
+
+    // Explicit, non-null community path prefix so behavior is deterministic
+    // (Site.getPathPrefix() is null/blank in a plain unit-test context).
+    private static final String PREFIX = '/community';
+
+    // ---- Safe / allowed inputs ----------------------------------------------
+
+    @isTest
+    static void allowsSafeRelativePath() {
+        System.assertEquals(
+            '/community/dashboard',
+            UIBundleAuthUtils.getSanitizedStartUrl('/dashboard', PREFIX),
+            'A safe community-relative path should be prefixed and preserved'
+        );
+    }
+
+    @isTest
+    static void allowsNestedRelativePath() {
+        System.assertEquals(
+            '/community/safe/relative/path',
+            UIBundleAuthUtils.getSanitizedStartUrl('/safe/relative/path', PREFIX),
+            'A nested relative path should be prefixed and preserved'
+        );
+    }
+
+    @isTest
+    static void blankAndRootFallBackToDefault() {
+        System.assertEquals(PREFIX, UIBundleAuthUtils.getSanitizedStartUrl(null, PREFIX), 'null -> default');
+        System.assertEquals(PREFIX, UIBundleAuthUtils.getSanitizedStartUrl('', PREFIX), 'empty -> default');
+        System.assertEquals(PREFIX, UIBundleAuthUtils.getSanitizedStartUrl('   ', PREFIX), 'whitespace -> default');
+        System.assertEquals(PREFIX, UIBundleAuthUtils.getSanitizedStartUrl('/', PREFIX), '"/" -> default');
+    }
+
+    // ---- Rejected / malicious inputs (all fall back to the default) ----------
+
+    @isTest
+    static void rejectsAbsoluteHttpUrl() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('https://evil-attacker.com', PREFIX),
+            'Absolute http(s) URL must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsProtocolRelativeUrl() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('//evil-attacker.com', PREFIX),
+            'Protocol-relative URL must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsAmbiguousScheme() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('https:evil-attacker.com', PREFIX),
+            'Malformed/ambiguous scheme must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsBackslashVariant() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('/\\evil-attacker.com', PREFIX),
+            'Backslash normalization trick must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsAtSign() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('/x@evil-attacker.com', PREFIX),
+            'User-info "@" must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsColon() {
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('/path:8080', PREFIX),
+            'Colon (port/scheme manipulation) must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsEncodedProtocolRelativeBypass() {
+        // %2f%2f decodes to // — the decode step must catch this.
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl('%2f%2fevil-attacker.com', PREFIX),
+            'URL-encoded protocol-relative bypass must be rejected'
+        );
+    }
+
+    @isTest
+    static void rejectsControlCharacters() {
+        String withNewline = '/foo' + String.fromCharArray(new List<Integer>{ 10 }) + 'bar';
+        System.assertEquals(
+            PREFIX,
+            UIBundleAuthUtils.getSanitizedStartUrl(withNewline, PREFIX),
+            'Embedded control characters must be rejected'
+        );
+    }
+
+    // ---- Supporting API coverage --------------------------------------------
+
+    @isTest
+    static void authExceptionCarriesStatusAndMessages() {
+        UIBundleAuthUtils.AuthException single = new UIBundleAuthUtils.AuthException(400, 'bad request');
+        System.assertEquals(400, single.statusCode, 'statusCode should round-trip');
+        System.assertEquals(1, single.messages.size(), 'single-message constructor');
+
+        UIBundleAuthUtils.AuthException multi =
+            new UIBundleAuthUtils.AuthException(500, new List<String>{ 'a', 'b' });
+        System.assertEquals(500, multi.statusCode, 'statusCode should round-trip');
+        System.assertEquals(2, multi.messages.size(), 'multi-message constructor');
+    }
+
+    @isTest
+    static void debugLogCompletesWithoutError() {
+        Test.startTest();
+        UIBundleAuthUtils.debugLog(new IllegalArgumentException('boom'), LoggingLevel.ERROR);
+        Test.stopTest();
+        System.assert(true, 'debugLog should complete without throwing');
+    }
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleAuthUtils_Test.cls-meta.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>67.0</apiVersion>
+    <status>Active</status>
+</ApexClass>

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig.cls

@@ -22,17 +22,9 @@ global with sharing class UIBundleSocialLoginConfig {
     @HttpGet
     global static SocialLoginConfigResponse getConfig() {
         try {
-            String startUrl = RestContext.request.params.get('startURL');
-            if (String.isBlank(startUrl)) {
-                startUrl = '/';
-            }
-
-            // Ensure startURL includes the community path prefix so post-auth
-            // redirect lands on the correct community (not the org default).
-            String pathPrefix = Site.getPathPrefix();
-            if (String.isNotBlank(pathPrefix) && !startUrl.startsWith(pathPrefix)) {
-                startUrl = pathPrefix + startUrl;
-            }
+            // Resolve the post-authentication redirect path, sanitized against
+            // open-redirect attacks (CWE-601). See resolveStartUrl.
+            String startUrl = resolveStartUrl();
 
             String communityUrl = Site.getBaseUrl();
             Auth.AuthConfiguration authConfig = new Auth.AuthConfiguration(communityUrl, startUrl);
@@ -89,6 +81,26 @@ global with sharing class UIBundleSocialLoginConfig {
         }
     }
 
+    /**
+     * Resolves the post-authentication redirect path from the request and
+     * sanitizes it to prevent open-redirect attacks (CWE-601).
+     *
+     * Delegates to the shared UIBundleAuthUtils.getSanitizedStartUrl — the same
+     * validation used by UIBundleLogin and UIBundleRegistration — which
+     * URL-decodes the value (catching encoded bypasses such as %2f%2f) and then
+     * rejects absolute, protocol-relative ("//"), backslash, "@", ":" and
+     * control-character inputs, falling back to the community path prefix. Only
+     * safe, community-relative paths survive, prefixed with Site.getPathPrefix()
+     * so the redirect lands on this community rather than the org default.
+     */
+    @TestVisible
+    private static String resolveStartUrl() {
+        return UIBundleAuthUtils.getSanitizedStartUrl(
+            RestContext.request.params.get('startURL'),
+            Site.getPathPrefix()
+        );
+    }
+
     global class SocialLoginConfigResponse {
         global List<AuthProviderInfo> authProviders;
         global List<SamlProviderInfo> samlProviders;

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig_Test.cls

@@ -98,4 +98,84 @@ private class UIBundleSocialLoginConfig_Test {
 
         Test.stopTest();
     }
+
+    // ---- Open-redirect sanitization (CWE-601) -------------------------------
+    // resolveStartUrl() is the boundary where the endpoint sanitizes the
+    // caller-supplied startURL before it is embedded in the SSO redirect URL.
+    // These tests assert malicious values never survive that boundary and that
+    // legitimate relative paths do.
+
+    @isTest
+    static void resolveStartUrlRejectsAbsoluteUrl() {
+        assertNotReflected('https://evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsProtocolRelativeUrl() {
+        assertNotReflected('//evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsBackslashVariant() {
+        assertNotReflected('/\\evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsEncodedBypass() {
+        assertNotReflected('%2f%2fevil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlAllowsRelativePath() {
+        setRequest('/dashboard');
+        String resolved = UIBundleSocialLoginConfig.resolveStartUrl();
+        System.assertNotEquals(null, resolved, 'A valid relative path should resolve to a non-null value');
+        System.assert(
+            resolved.endsWith('/dashboard'),
+            'A valid relative path must be preserved (optionally prefixed): ' + resolved
+        );
+        System.assert(!resolved.startsWith('http'), 'Result must not be absolute: ' + resolved);
+    }
+
+    @isTest
+    static void getConfigWithMaliciousStartUrlReturnsGracefulEmpty() {
+        // End-to-end: a malicious startURL must not crash the endpoint; without
+        // a real site context it returns the graceful empty response (unchanged).
+        setRequest('https://evil-attacker.com');
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Response should not be null');
+        System.assertEquals(0, result.authProviders.size(), 'No providers without site context');
+        System.assertEquals(0, result.samlProviders.size(), 'No SAML providers without site context');
+        System.assertEquals(null, result.autoRedirectUrl, 'No auto-redirect without providers');
+    }
+
+    // ---- helpers ------------------------------------------------------------
+
+    /** Asserts a malicious startURL value is not reflected by resolveStartUrl(). */
+    private static void assertNotReflected(String maliciousStartUrl) {
+        setRequest(maliciousStartUrl);
+        String resolved = UIBundleSocialLoginConfig.resolveStartUrl();
+        String safe = resolved == null ? '' : resolved;
+        System.assert(!safe.contains('evil-attacker'), 'Malicious host must not be reflected: ' + safe);
+        System.assert(!safe.startsWith('http'), 'Result must not be an absolute URL: ' + safe);
+        System.assert(!safe.startsWith('//'), 'Result must not be protocol-relative: ' + safe);
+        System.assert(!safe.contains('\\'), 'Result must not contain a backslash: ' + safe);
+    }
+
+    /** Builds a GET RestContext with the given startURL param (null => param omitted). */
+    private static void setRequest(String startUrlValue) {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        if (startUrlValue != null) {
+            req.params.put('startURL', startUrlValue);
+        }
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+    }
 }

package/lib/templates/project/reactexternalapp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "11.64.0",
+  "version": "12.4.5",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {

package/lib/templates/project/reactexternalapp/scripts/org-setup-config-schema.mjs

@@ -72,13 +72,25 @@ export const ConfigSchema = z
         // Required because React (Site Container) sites hide SSO config in Admin UI.
         authProviderNames: z.array(z.string().min(1)).min(1),
         // Permission set to assign to community users created via SSO.
-        // Required because getCurrentUser() calls /chatter/users/me which needs
-        // API access (PermissionsApiEnabled) that the community profile lacks.
+        // Required because getCurrentUser() calls UI API GraphQL (uiapi.currentUser)
+        // which needs API access (PermissionsApiEnabled) that the community profile lacks.
         // Typically the app's "*_Guest_User_Api_Access" permset.
         communityUserPermset: z.string().min(1).optional(),
       })
       .strict()
       .optional(),
+    // URL members are redirected to after logging out, written to the site's
+    // <logoutUrl> network metadata (a post-deploy step). Steers logout back to THIS
+    // site so members aren't dropped on the org default-site login (which, in an
+    // org hosting multiple sites, can be a different community). Prefer a
+    // site-relative path (e.g. "/myapp/"): it is domain-independent, so the same
+    // shipped value is valid on every org. The platform REQUIRES an absolute logout
+    // URL, so org-setup resolves a relative path against the site's Experience Cloud
+    // origin (discovered from the org at deploy time) before writing it; an
+    // already-absolute value is used as-is. Kept a permissive non-empty string (not
+    // z.string().url()) so relative paths are valid; character-safety for raw XML
+    // interpolation is enforced at write time.
+    logoutUrl: z.string().min(1).optional(),
   })
   .strict();
 

package/lib/templates/project/reactexternalapp/scripts/org-setup-dev.mjs

@@ -60,6 +60,31 @@ Options:
   return { targetOrg, uiBundleName };
 }
 
+/**
+ * Print a heads-up about auth surfaces that only work on the deployed Experience
+ * site. In local preview, `sdk.fetch` is proxied to the org outside the site's
+ * guest/community context, so social login and password/MFA login cannot be
+ * exercised on localhost. This mirrors the "Local preview limitations" sections
+ * in the feature-react-authentication / feature-react-mfa READMEs — surfaced here
+ * so it is seen even when the READMEs are not.
+ */
+function printLocalPreviewWarning() {
+  console.log(
+    [
+      '',
+      '⚠️  Local preview limitation — some auth surfaces only work on the DEPLOYED site',
+      '   Local preview proxies sdk.fetch to the org outside the Experience site guest',
+      '   context (Site.getBaseUrl() is blank, no site session), so on localhost:',
+      '     • Social Login buttons do not render (/auth/social-login-config returns no providers)',
+      '     • Password / MFA login fails with "Your login attempt has failed…" (Site.login() cannot',
+      '       establish the site session)',
+      '   This is expected, not a misconfiguration. Test social login and MFA on the published',
+      '   site login page: https://<domain>.site.com/<site-path>/login',
+      '',
+    ].join('\n'),
+  );
+}
+
 async function main() {
   const parsed = parseArgs();
 
@@ -76,6 +101,8 @@ async function main() {
   });
   run('GraphQL codegen', 'npm', ['run', 'graphql:codegen'], { cwd: uiBundleDir });
 
+  printLocalPreviewWarning();
+
   console.log('\n--- Launching dev server (Ctrl+C to stop) ---\n');
   const devResult = run('Dev server', 'npm', ['run', 'dev'], { cwd: uiBundleDir, optional: true });
   process.exit(devResult.status ?? 0);