@sbc-connect/nuxt-auth 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @sbc-connect/nuxt-auth
 
+## 0.8.0
+
+### Minor Changes
+
+- [#140](https://github.com/bcgov/connect-nuxt/pull/140) [`7704fda`](https://github.com/bcgov/connect-nuxt/commit/7704fda8e016b67d0928964652e94f0bb792ff6c) Thanks [@cameron-eyds](https://github.com/cameron-eyds)! - Param preservation in expiry logout and header login
+
+### Patch Changes
+
+- Updated dependencies [[`83c5627`](https://github.com/bcgov/connect-nuxt/commit/83c5627689a50d6fa27f12f2ab7b2ef65e752d0e)]:
+  - @sbc-connect/nuxt-forms@0.6.2
+
+## 0.7.1
+
+### Patch Changes
+
+- Updated dependencies [[`e6dc55d`](https://github.com/bcgov/connect-nuxt/commit/e6dc55d18b84754e2416112ebbf42b780b8bb3ac)]:
+  - @sbc-connect/nuxt-base@0.7.1
+  - @sbc-connect/nuxt-forms@0.6.1
+
 ## 0.7.0
 
 ### Minor Changes

package/app/components/Connect/Modal/SessionExpired.vue

@@ -4,11 +4,25 @@ const rtc = useRuntimeConfig().public
 const modalTimeout = rtc.sessionModalTimeout ? Number(rtc.sessionModalTimeout) : 120000
 const { t } = useI18n()
 const route = useRoute()
+const localePath = useLocalePath()
 
 const emit = defineEmits<{ close: [] }>()
 
 const timeRemaining = ref(toValue((modalTimeout) / 1000))
 
+// Capture the user's current location when the modal opens, before any potential URL changes
+const capturedUrl = `${window.location.origin}${route.fullPath}`
+
+/** Build a login page URL with a return param preserving the user's current location.
+ *  The return value is double-encoded so it survives the Keycloak redirect decode
+ *  without the original query params bleeding into the login page's query string.
+ */
+function getSessionExpiredRedirect(): string {
+  const loginPath = localePath('/auth/login')
+  const returnUrl = encodeURIComponent(encodeURIComponent(capturedUrl))
+  return `${window.location.origin}${loginPath}?return=${returnUrl}`
+}
+
 const intervalId = setInterval(async () => {
   const value = timeRemaining.value - 1
   timeRemaining.value = value < 0 ? 0 : value
@@ -18,7 +32,7 @@ const intervalId = setInterval(async () => {
       await route.meta.onBeforeSessionExpired()
     }
     sessionStorage.setItem(ConnectAuthStorageKey.CONNECT_SESSION_EXPIRED, 'true')
-    await useConnectAuth().logout()
+    await useConnectAuth().logout(getSessionExpiredRedirect())
   }
 }, 1000)
 

package/app/composables/useConnectAccountFlowRedirect.ts

@@ -6,7 +6,9 @@ export const useConnectAccountFlowRedirect = () => {
     const { currentAccount, userAccounts } = useConnectAccountStore()
     const localePath = useLocalePath()
     const ac = useAppConfig().connect.login
-    const externalRedirectUrl = route.query.return as string | undefined
+    const externalRedirectUrl = route.query.return
+      ? decodeURIComponent(route.query.return as string)
+      : undefined
     const internalRedirectUrl = ac.redirect
     const query = { ...route.query }
     query.accountid = String(currentAccount.id)

package/app/composables/useConnectAuth.ts

@@ -30,9 +30,7 @@ export const useConnectAuth = () => {
 
     if (siteminderUrl) {
       const cleanedUri = redirectUri.replace(/(https?:\/\/)|(\/)+/g, '$1$2')
-      const queryString = window.location.search
-      const returlValue = queryString ? `${cleanedUri}${queryString}` : cleanedUri
-      redirectUri = `${siteminderUrl}?returl=${returlValue}&retnow=1`
+      redirectUri = `${siteminderUrl}?returl=${encodeURIComponent(cleanedUri)}&retnow=1`
     }
 
     resetPiniaStores()

package/app/composables/useConnectHeaderOptions.ts

@@ -10,7 +10,7 @@ export function useConnectHeaderOptions() {
   const ac = useAppConfig().connect
   const route = useRoute()
   const overlay = useOverlay()
-  const { t, locale: { value: locale } } = useNuxtApp().$i18n
+  const { t } = useNuxtApp().$i18n
   const { login, isAuthenticated, authUser } = useConnectAuth()
   const accountStore = useConnectAccountStore()
   const localePath = useLocalePath()
@@ -135,9 +135,13 @@ export function useConnectHeaderOptions() {
     return options
   })
 
-  const loginRedirectUrl = ac.login.redirect
-    ? appBaseUrl + locale + ac.login.redirect
-    : undefined
+  // Build a redirect URL through the login page so the connect-auth middleware
+  // processes query params (e.g. 'return') after Keycloak authentication
+  function getLoginRedirectUrl(): string {
+    const loginPath = localePath('/auth/login')
+    const queryString = window.location.search
+    return `${appBaseUrl}${loginPath.startsWith('/') ? loginPath.slice(1) : loginPath}${queryString}`
+  }
 
   const loginOptionsMap: Record<'bcsc' | 'bceid' | 'idir',
     { label: string, icon: string, onSelect: () => Promise<void> }
@@ -145,17 +149,17 @@ export function useConnectHeaderOptions() {
     bcsc: {
       label: t('connect.label.bcsc'),
       icon: 'i-mdi-account-card-details-outline',
-      onSelect: () => login(ConnectIdpHint.BCSC, loginRedirectUrl)
+      onSelect: () => login(ConnectIdpHint.BCSC, getLoginRedirectUrl())
     },
     bceid: {
       label: t('connect.label.bceid'),
       icon: 'i-mdi-two-factor-authentication',
-      onSelect: () => login(ConnectIdpHint.BCEID, loginRedirectUrl)
+      onSelect: () => login(ConnectIdpHint.BCEID, getLoginRedirectUrl())
     },
     idir: {
       label: t('connect.label.idir'),
       icon: 'i-mdi-account-group-outline',
-      onSelect: () => login(ConnectIdpHint.IDIR, loginRedirectUrl)
+      onSelect: () => login(ConnectIdpHint.IDIR, getLoginRedirectUrl())
     }
   }
 

package/app/plugins/connect-auth.client.ts

@@ -15,6 +15,19 @@ export default defineNuxtPlugin(async () => {
   const tokenMinValidity = rtc.tokenMinValidity ? Number(rtc.tokenMinValidity) / 1000 : 120
   const sessionInactivityTimeout = rtc.sessionInactivityTimeout ? Number(rtc.sessionInactivityTimeout) : 1800000
 
+  // Logout via Keycloak, redirecting to the login page with a return param preserving the user's current URL.
+  // The return value is double-encoded so it survives the Keycloak redirect decode
+  // without the original query params bleeding into the login page's query string.
+  function logoutWithReturn(kc: Keycloak) {
+    const localePath = useLocalePath()
+    const route = useRoute()
+    const loginPath = localePath('/auth/login')
+    const currentUrl = `${window.location.origin}${route.fullPath}`
+    const returnUrl = encodeURIComponent(encodeURIComponent(currentUrl))
+    const redirectUri = `${window.location.origin}${loginPath}?return=${returnUrl}`
+    kc.logout({ redirectUri })
+  }
+
   try {
     // default behaviour when keycloak session expires
     // try to update token - log out if token update fails
@@ -27,7 +40,7 @@ export default defineNuxtPlugin(async () => {
         console.info('[Auth] Token refreshed.')
       } catch (error) {
         console.error('[Auth] Failed to refresh token on expiration; logging out.', error)
-        keycloak.logout()
+        logoutWithReturn(keycloak)
       }
     }
 
@@ -62,7 +75,7 @@ export default defineNuxtPlugin(async () => {
           console.info('[Auth] Token refreshed.')
         } catch (error) {
           console.error('[Auth] Failed to refresh token; logging out.', error)
-          keycloak.logout() // log user out if token update fails
+          logoutWithReturn(keycloak)
         }
       }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sbc-connect/nuxt-auth",
   "type": "module",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "repository": "github:bcgov/connect-nuxt",
   "license": "BSD-3-Clause",
   "main": "./nuxt.config.ts",
@@ -22,8 +22,8 @@
     "keycloak-js": "26.2.2",
     "pinia": "3.0.4",
     "pinia-plugin-persistedstate": "4.7.1",
-    "@sbc-connect/nuxt-base": "0.7.0",
-    "@sbc-connect/nuxt-forms": "0.6.0"
+    "@sbc-connect/nuxt-base": "0.7.1",
+    "@sbc-connect/nuxt-forms": "0.6.2"
   },
   "scripts": {
     "preinstall": "npx only-allow pnpm",