pinokiod 5.3.8 → 5.3.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "5.3.8",
+  "version": "5.3.10",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -4932,7 +4932,7 @@ class Server {
 
 	    // Registry linking endpoint
 		    this.app.get("/registry/link", ex(async (req, res) => {
-		      const { token, registry, app: appOrigin, next: nextRaw } = req.query
+		      const { token, registry, app: appOrigin, next: nextRaw, pinokioNext: pinokioNextRaw } = req.query
 	
 	      if (!token || !registry) {
 	        res.status(400).render("registry_link", {
@@ -4972,6 +4972,27 @@ class Server {
 	          if (candidate.origin === base.origin) redirectUrl = candidate.toString()
 	        } catch (_) {}
 	      }
+
+	      if (pinokioNextRaw) {
+	        try {
+	          const nextVal = String(pinokioNextRaw)
+	          const protocol = (req.$source && req.$source.protocol) || req.get("X-Forwarded-Proto") || "http"
+	          const host = (req.$source && req.$source.host) || req.get("host")
+	          const base = new URL(`${protocol}://${host}`)
+	          let candidate = null
+	          if (nextVal.startsWith("/") && !nextVal.startsWith("//")) {
+	            if (nextVal.startsWith("/registry/checkin")) {
+	              candidate = new URL(nextVal, base.toString())
+	            }
+	          } else {
+	            const parsed = new URL(nextVal)
+	            if (parsed.origin === base.origin && parsed.pathname.startsWith("/registry/checkin")) {
+	              candidate = parsed
+	            }
+	          }
+	          if (candidate && candidate.origin === base.origin) redirectUrl = candidate.toString()
+	        } catch (_) {}
+	      }
 	
 	      try {
 	        // Exchange token for API key at the specified registry

package/server/views/registry_checkin.ejs

@@ -170,6 +170,31 @@
         return null;
       };
 
+      const buildConnectUrl = (rawUrl) => {
+        if (!rawUrl) return null;
+        try {
+          const u = new URL(rawUrl);
+          if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+          const pinokioNext = `${window.location.pathname}${window.location.search}${window.location.hash || ''}`;
+          if (pinokioNext.startsWith('/') && !pinokioNext.startsWith('//')) {
+            u.searchParams.set('pinokioNext', pinokioNext);
+          }
+          if (data.returnUrl) {
+            try {
+              const ret = new URL(data.returnUrl);
+              const nextPath = `${ret.pathname}${ret.search}${ret.hash || ''}`;
+              if (nextPath.startsWith('/') && !nextPath.startsWith('//')) {
+                u.searchParams.set('next', nextPath);
+              }
+            } catch (err) {}
+          }
+          u.searchParams.set('pinokioUrl', window.location.origin);
+          return u.toString();
+        } catch (err) {
+          return null;
+        }
+      };
+
       const candidates = Array.isArray(data.candidates) ? data.candidates : [];
       const repoLabel = data.repoUrl ? `Repo: ${data.repoUrl}` : 'Missing repo URL';
       if (repoEl) repoEl.textContent = repoLabel;
@@ -254,6 +279,11 @@
             return;
           }
           if (publish && publish.code === 'not_linked') {
+            const connectUrl = buildConnectUrl(publish.connectUrl || '');
+            if (connectUrl) {
+              window.location.href = connectUrl;
+              return;
+            }
             redirectToReturn({ error: 'not_linked', connectUrl: publish.connectUrl || '' });
             return;
           }