zudoku 0.43.2 → 0.44.0

package/lib/zudoku.components.js

@@ -3,7 +3,7 @@ import "./index-DwT-v3zK.js";
 import "./chunk-BAXFHI7N-BLTsN6tl.js";
 import "./hook-8GM2HXNM.js";
 import "./SlotletProvider-wWbHYqWf.js";
-import { e as d, f as k, n as l, B as S, C as h, j as B, l as c, H as E, d as H, L, M, g as R, R as Z, S as f, k as g, i as y, Z as A, a as b, h as j, c as v, m as w, b as x } from "./index-DGNSSXgR.js";
+import { e as d, f as k, n as l, B as S, C as h, j as B, l as c, H as E, d as H, L, M, g as R, R as Z, S as f, k as g, i as y, Z as A, b, h as j, c as v, m as w, a as x } from "./index-CzUOM_vE.js";
 import "./ui/Button.js";
 import "./ui/Callout.js";
 import "./ClientOnly-E7hGysn1.js";

package/lib/zudoku.plugin-api-catalog.js

@@ -3,7 +3,7 @@ import { s as h } from "./index-LNp6rxyU.js";
 import { d as b, m as x } from "./chunk-BAXFHI7N-BLTsN6tl.js";
 import { u as j, d as y, f as p } from "./hook-8GM2HXNM.js";
 import { H as v } from "./RouteGuard-D2gX29iI.js";
-import { L as N } from "./index-DGNSSXgR.js";
+import { L as N } from "./index-CzUOM_vE.js";
 import { H as S, M as w } from "./Markdown-DvdVn1O7.js";
 const H = ({
   items: r,

package/lib/zudoku.plugin-markdown.js

@@ -53,7 +53,7 @@ const P = (e) => ({
         const u = {
           path: r,
           lazy: async () => {
-            const { MdxPage: p } = await import("./MdxPage-DUcuusMU.js"), { default: f, ...l } = await i();
+            const { MdxPage: p } = await import("./MdxPage-DlJaCSPf.js"), { default: f, ...l } = await i();
             return {
               element: /* @__PURE__ */ d.jsx(
                 p,

package/lib/zudoku.plugin-openapi.js

@@ -3,7 +3,7 @@ import "lucide-react";
 import "./chunk-BAXFHI7N-BLTsN6tl.js";
 import "./hook-8GM2HXNM.js";
 import "./ui/Button.js";
-import { z as a, U as s, A } from "./index-CFf9AN-y.js";
+import { z as a, U as s, A } from "./index-C56xKbMM.js";
 export {
   a as GetSidebarOperationsQuery,
   s as UNTAGGED_PATH,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zudoku",
-  "version": "0.43.2",
+  "version": "0.44.0",
   "type": "module",
   "homepage": "https://zudoku.dev",
   "repository": {

package/src/lib/authentication/components/CallbackHandler.tsx

@@ -1,18 +1,28 @@
 import { useSuspenseQuery } from "@tanstack/react-query";
 import { Navigate } from "react-router";
+import { useZudoku } from "zudoku/components";
 import { ZudokuError } from "../../util/invariant.js";
+import { joinUrl } from "../../util/joinUrl.js";
+import { normalizeRedirectUrl } from "../../util/url.js";
 
 export function CallbackHandler({
   handleCallback,
 }: {
   handleCallback: () => Promise<string>;
 }) {
+  const { options } = useZudoku();
   const executeCallback = useSuspenseQuery({
     retry: false,
     queryKey: ["oauth-callback"],
     queryFn: async () => {
       try {
-        return await handleCallback();
+        return joinUrl(
+          normalizeRedirectUrl(
+            await handleCallback(),
+            window.location.origin,
+            options.basePath,
+          ),
+        );
       } catch (error) {
         throw new ZudokuError("Could not validate user", {
           cause: error,

package/src/lib/authentication/providers/auth0.tsx

@@ -37,7 +37,7 @@ class Auth0AuthenticationProvider extends OpenIDAuthenticationProvider {
     });
 
     const redirectUrl = new URL(window.location.origin);
-    redirectUrl.pathname = this.logoutRedirectUrlPath;
+    redirectUrl.pathname = this.redirectToAfterSignOut;
 
     // SEE: https://auth0.com/docs/authenticate/login/logout/log-users-out-of-auth0
     // For Auth0 tenants created on or after 14 November 2023, RP-Initiated

package/src/lib/authentication/providers/clerk.tsx

@@ -50,8 +50,8 @@ const clerkAuth: AuthenticationProviderInitializer<
 > = ({
   clerkPubKey,
   redirectToAfterSignOut = "/",
-  redirectToAfterSignUp = "/",
-  redirectToAfterSignIn = "/",
+  redirectToAfterSignUp,
+  redirectToAfterSignIn,
 }) => {
   let clerkApi: Clerk | undefined;
   const ensureLoaded = (async () => {
@@ -129,19 +129,23 @@ const clerkAuth: AuthenticationProviderInitializer<
     signIn: async ({ redirectTo }: { redirectTo?: string } = {}) => {
       await ensureLoaded;
       await clerkApi?.redirectToSignIn({
-        signInForceRedirectUrl:
-          redirectTo ?? window.location.origin + redirectToAfterSignIn,
-        signUpForceRedirectUrl:
-          redirectTo ?? window.location.origin + redirectToAfterSignUp,
+        signInForceRedirectUrl: redirectToAfterSignIn
+          ? window.location.origin + redirectToAfterSignIn
+          : redirectTo,
+        signUpForceRedirectUrl: redirectToAfterSignUp
+          ? window.location.origin + redirectToAfterSignUp
+          : redirectTo,
       });
     },
     signUp: async ({ redirectTo }: { redirectTo?: string } = {}) => {
       await ensureLoaded;
       await clerkApi?.redirectToSignUp({
-        signInForceRedirectUrl:
-          redirectTo ?? window.location.origin + redirectToAfterSignIn,
-        signUpForceRedirectUrl:
-          redirectTo ?? window.location.origin + redirectToAfterSignUp,
+        signInForceRedirectUrl: redirectToAfterSignIn
+          ? window.location.origin + redirectToAfterSignIn
+          : redirectTo,
+        signUpForceRedirectUrl: redirectToAfterSignUp
+          ? window.location.origin + redirectToAfterSignUp
+          : redirectTo,
       });
     },
     getAuthenticationPlugin() {

package/src/lib/authentication/providers/openid.tsx

@@ -23,18 +23,17 @@ export interface OpenIdProviderData {
   tokenType: string;
 }
 
+export const OPENID_CALLBACK_PATH = "/oauth/callback";
+
 class OpenIdAuthPlugin extends AuthenticationPlugin {
-  constructor(
-    private callbackUrlPath: string,
-    private handleCallback: () => Promise<string>,
-  ) {
+  constructor(private handleCallback: () => Promise<string>) {
     super();
   }
   getRoutes() {
     return [
       ...super.getRoutes(),
       {
-        path: this.callbackUrlPath,
+        path: OPENID_CALLBACK_PATH,
         element: (
           <ClientOnly>
             <CallbackHandler handleCallback={this.handleCallback} />
@@ -48,29 +47,28 @@ class OpenIdAuthPlugin extends AuthenticationPlugin {
 export class OpenIDAuthenticationProvider implements AuthenticationProvider {
   protected client: oauth.Client;
   protected issuer: string;
-
   protected authorizationServer: oauth.AuthorizationServer | undefined;
 
-  protected absoluteCallbackUrlPath: string;
-  protected relativeCallbackUrlPath: string;
-  protected logoutRedirectUrlPath: string;
+  protected callbackUrlPath: string;
+
   protected onAuthorizationUrl?: (
     authorizationUrl: URL,
     options: { isSignIn: boolean; isSignUp: boolean },
   ) => void;
-  private readonly redirectToAfterSignUp: string;
-  private readonly redirectToAfterSignIn: string;
-  private readonly redirectToAfterSignOut: string;
+
+  protected readonly redirectToAfterSignUp: string | undefined;
+  protected readonly redirectToAfterSignIn: string | undefined;
+  protected readonly redirectToAfterSignOut: string;
   private readonly audience?: string;
   private readonly scopes: string[];
-  private readonly root: string;
+
   constructor({
     issuer,
     audience,
     clientId,
     redirectToAfterSignUp,
     redirectToAfterSignIn,
-    redirectToAfterSignOut,
+    redirectToAfterSignOut = "/",
     basePath,
     scopes,
   }: OpenIDAuthenticationConfig) {
@@ -80,19 +78,13 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
     };
     this.audience = audience;
     this.issuer = issuer;
-    this.relativeCallbackUrlPath = "/oauth/callback";
-    this.absoluteCallbackUrlPath = joinUrl(
-      basePath,
-      this.relativeCallbackUrlPath,
-    );
+    // This is the callback URL for the OAuth provider. So it needs the base path.
+    this.callbackUrlPath = joinUrl(basePath, OPENID_CALLBACK_PATH);
     this.scopes = scopes ?? ["openid", "profile", "email"];
 
-    this.root = joinUrl(basePath, "/");
-
-    this.logoutRedirectUrlPath = this.root;
-    this.redirectToAfterSignUp = redirectToAfterSignUp ?? this.root;
-    this.redirectToAfterSignIn = redirectToAfterSignIn ?? this.root;
-    this.redirectToAfterSignOut = redirectToAfterSignOut ?? this.root;
+    this.redirectToAfterSignUp = redirectToAfterSignUp;
+    this.redirectToAfterSignIn = redirectToAfterSignIn;
+    this.redirectToAfterSignOut = redirectToAfterSignOut;
   }
 
   protected async getAuthServer() {
@@ -138,14 +130,14 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
 
   async signUp({ redirectTo }: { redirectTo?: string } = {}) {
     return this.authorize({
-      redirectTo: redirectTo ?? this.redirectToAfterSignUp,
+      redirectTo: this.redirectToAfterSignUp ?? redirectTo ?? "/",
       isSignUp: true,
     });
   }
 
   async signIn({ redirectTo }: { redirectTo?: string } = {}) {
     return this.authorize({
-      redirectTo: redirectTo ?? this.redirectToAfterSignIn,
+      redirectTo: this.redirectToAfterSignIn ?? redirectTo ?? "/",
     });
   }
 
@@ -178,17 +170,10 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
       authorizationServer.authorization_endpoint,
     );
 
-    const finalRedirect = redirectTo.startsWith(window.location.origin)
-      ? this.root !== "/" &&
-        redirectTo.startsWith(window.location.origin + this.root)
-        ? redirectTo.slice(window.location.origin.length + this.root.length)
-        : redirectTo.slice(window.location.origin.length)
-      : redirectTo;
-
-    sessionStorage.setItem("redirect-to", finalRedirect);
+    sessionStorage.setItem("redirect-to", redirectTo);
 
     const redirectUrl = new URL(window.location.origin);
-    redirectUrl.pathname = this.absoluteCallbackUrlPath;
+    redirectUrl.pathname = this.callbackUrlPath;
     redirectUrl.search = "";
 
     authorizationUrl.searchParams.set("client_id", this.client.client_id);
@@ -282,7 +267,7 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
     const redirectUrl = new URL(
       window.location.origin + this.redirectToAfterSignOut,
     );
-    redirectUrl.pathname = this.logoutRedirectUrlPath;
+    redirectUrl.pathname = this.callbackUrlPath;
 
     let logoutUrl: URL;
     // The endSessionEndpoint is set, the IdP supports some form of logout,
@@ -338,7 +323,7 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
     }
 
     const redirectUrl = new URL(url);
-    redirectUrl.pathname = this.absoluteCallbackUrlPath;
+    redirectUrl.pathname = this.callbackUrlPath;
     redirectUrl.search = "";
 
     const response = await oauth.authorizationCodeGrantRequest(
@@ -396,10 +381,7 @@ export class OpenIDAuthenticationProvider implements AuthenticationProvider {
   getAuthenticationPlugin() {
     // TODO: This API is a bit messy, we need to refactor auth plugins/providers
     // to remove the extra layers of abstraction.
-    return new OpenIdAuthPlugin(
-      this.relativeCallbackUrlPath,
-      this.handleCallback,
-    );
+    return new OpenIdAuthPlugin(this.handleCallback);
   }
 }
 

package/src/lib/plugins/openapi/playground/QueryParams.tsx

@@ -111,7 +111,7 @@ export const QueryParams = ({
                             field.onChange(e);
                             form.setValue(`queryParams.${i}.active`, true);
                           }}
-                          className="font-mono text-xs border-0 ring-1 ring-ring"
+                          className="font-mono text-xs border-0 shadow-none"
                         />
                       );
                     }}

package/src/lib/util/url.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { normalizeRedirectUrl } from "./url.js";
+
+describe("normalizeRedirectUrl", () => {
+  const mockOrigin = "https://example.com";
+
+  it("should return original URL if it doesn't start with origin", () => {
+    const result = normalizeRedirectUrl(
+      "https://other.com/path",
+      mockOrigin,
+      "/",
+    );
+    expect(result).toBe("https://other.com/path");
+  });
+
+  it("should remove origin when root is /", () => {
+    const result = normalizeRedirectUrl(
+      "https://example.com/some/path",
+      mockOrigin,
+      "/",
+    );
+    expect(result).toBe("/some/path");
+  });
+
+  it("should remove origin and root path when root is not /", () => {
+    const result = normalizeRedirectUrl(
+      "https://example.com/docs/some/path",
+      mockOrigin,
+      "/docs",
+    );
+    expect(result).toBe("/some/path");
+  });
+
+  it("should only remove origin when URL doesn't match root path", () => {
+    const result = normalizeRedirectUrl(
+      "https://example.com/other/path",
+      mockOrigin,
+      "/docs",
+    );
+    expect(result).toBe("/other/path");
+  });
+
+  it("should handle empty root path", () => {
+    const result = normalizeRedirectUrl(
+      "https://example.com/path",
+      mockOrigin,
+      "",
+    );
+    expect(result).toBe("/path");
+  });
+});

package/src/lib/util/url.ts

@@ -0,0 +1,18 @@
+/**
+ * Normalizes a redirect URL by removing the origin and optionally the root path
+ */
+export function normalizeRedirectUrl(
+  redirectTo: string,
+  origin: string,
+  basePath: string = "/",
+): string {
+  if (!redirectTo.startsWith(origin)) {
+    return redirectTo;
+  }
+
+  if (basePath !== "/" && redirectTo.startsWith(origin + basePath)) {
+    return redirectTo.slice(origin.length + basePath.length);
+  }
+
+  return redirectTo.slice(origin.length);
+}