zitejs 0.9.91 → 0.9.92

package/dist/cjs/auth/index.js

@@ -42,9 +42,17 @@ function loginWithRedirect(opts) {
     // any non-ASCII in the path fails its regex and the destination is dropped —
     // but never inspects the path of an absolute one. Normalising here means a
     // caller can pass whichever form reads best without having to know that.
-    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
-    window.location.href =
-        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 function logout(opts) {
     (0, exports.signOut)().then(() => {

package/dist/cjs/auth/index.test.js

@@ -83,6 +83,24 @@ function redirectParamOf(href) {
     });
 });
 (0, vitest_1.describe)('loginWithRedirect', () => {
+    (0, vitest_1.it)('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
     (0, vitest_1.it)('captures the current URL when called with no arguments', () => {
         const location = stubLocation('https://app.zite.so/orders/123?tab=open');
         authExports.loginWithRedirect();

package/dist/esm/auth/index.js

@@ -35,9 +35,17 @@ export function loginWithRedirect(opts) {
     // any non-ASCII in the path fails its regex and the destination is dropped —
     // but never inspects the path of an absolute one. Normalising here means a
     // caller can pass whichever form reads best without having to know that.
-    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
-    window.location.href =
-        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 export function logout(opts) {
     signOut().then(() => {

package/dist/esm/auth/index.test.js

@@ -48,6 +48,24 @@ describe('zitejs/auth exports', () => {
     });
 });
 describe('loginWithRedirect', () => {
+    it('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        expect(location.href).toBe('/auth/login');
+    });
+    it('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        expect(location.href).toBe('/auth/login');
+    });
+    it('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
     it('captures the current URL when called with no arguments', () => {
         const location = stubLocation('https://app.zite.so/orders/123?tab=open');
         authExports.loginWithRedirect();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.91",
+  "version": "0.9.92",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",