@tristan2828/ui-foundation 3.27.1 → 3.27.3

package/dist/auth/auth-provider.js

@@ -86,9 +86,16 @@ export function AuthProvider({ children }) {
     async function login(email, password) {
         startSession(queryClient, await loginRequest({ email, password }));
     }
+    // Logged out on screen even when the request fails (network down): the
+    // person asked to leave, and a shell that still shows them signed in is
+    // worse. Still rejects, so the caller knows the server didn't confirm.
     async function logout() {
-        await logoutRequest();
-        endSession(queryClient);
+        try {
+            await logoutRequest();
+        }
+        finally {
+            endSession(queryClient);
+        }
     }
     async function register(email, name, password) {
         startSession(queryClient, await registerRequest({ email, name, password }));

package/dist/components/app/app-shell.js

@@ -71,6 +71,9 @@ export function AppShell({ title, nav, sidebarExtra, defaultSidebarOpen = true }
                                                             return (_jsx(SidebarMenuItem, { children: _jsxs(SidebarMenuButton, { isActive: isActive, tooltip: label, render: _jsx(NavLink, { to: to, end: end }), children: [_jsx(Icon, {}), _jsx("span", { children: label })] }) }, to));
                                                         }) }) })] }), sidebarExtra] }), _jsx(SidebarFooter, { children: _jsxs("div", { className: "flex items-center justify-between gap-2 px-2 group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:px-0", children: [_jsx("span", { className: "truncate type-caption text-sidebar-foreground/70 group-data-[collapsible=icon]:hidden", children: user.name }), _jsx(Button, { variant: "ghost", size: "icon-sm", "aria-label": "Log out", onClick: () => {
                                                     setIsLoggingOut(true);
-                                                    logout().catch(() => setIsLoggingOut(false));
+                                                    // A failed request still ends the session on screen
+                                                    // (AuthProvider), so this stays a deliberate logout: a
+                                                    // clean /login, never the previous user's page as `from`.
+                                                    logout().catch(() => { });
                                                 }, children: _jsx(LogOutIcon, {}) })] }) })] }) }), _jsxs(SidebarInset, { className: "min-w-0", children: [_jsxs("header", { className: "flex h-14 shrink-0 items-center gap-2 border-b border-border px-4", children: [_jsx(SidebarTrigger, {}), _jsx("div", { className: "flex-1" }), _jsx(ThemeToggle, {})] }), _jsx("div", { className: "flex-1 p-6", children: _jsx(Outlet, {}) })] })] }), _jsx(Toaster, { position: "top-center" })] }));
 }

package/dist/lib/link-href.js

@@ -1,7 +1,7 @@
 // The address a link in the rich-text editor points at, from what the
 // person typed. Web and email addresses only: a bare `example.com` becomes
 // `https://example.com` and a bare `name@example.com` a `mailto:`; a path
-// on this site (`/x`) or a heading (`#x`) is kept. Any other scheme
+// on this site (`/x`, never `//x`) or a heading (`#x`) is kept. Any other scheme
 // (`javascript:`, `data:`, `file:`) is refused, so a link can't run code
 // or reach a local file.
 /** The `href` to save, `''` to remove the link, or `null` when it's refused. */
@@ -14,6 +14,10 @@ export function linkHref(typed) {
     // A scheme of its own (`javascript:`), not a port (`example.com:8080`).
     if (/^[a-z][a-z0-9+.-]*:(?!\d)/i.test(value))
         return null;
+    // `//evil.com` (and `/\evil.com`, which browsers read the same way) is
+    // another site, not a path on this one.
+    if (/^\/[/\\]/.test(value))
+        return null;
     if (value.startsWith('/') || value.startsWith('#'))
         return value;
     if (/^[^\s@/]+@[^\s@/]+\.[^\s@/]+$/.test(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tristan2828/ui-foundation",
-  "version": "3.27.1",
+  "version": "3.27.3",
   "description": "Shared UI foundation for contract-first, database-backed React apps: shadcn primitives, DataTable/EntityForm composites, auth, the gateway error seam, design tokens, lint rules and the AI playbook.",
   "license": "MIT",
   "repository": {