xarmian 8cdf582066 fix(auth): full-page navigation for server-owned post-auth redirect targets (BUG-1083) (#386) ...

Unauthenticated users hitting /oauth/authorize were 302'd through /login,
but the post-login goto(redirectTarget) used SvelteKit's client-side router
to navigate back to /oauth/authorize — a Go-server route with no SPA match.
SvelteKit fell into the [username]/[workspace] catchall, parsed it as
username="oauth" + workspace="authorize", and rendered "No dashboard data
available."

Add isServerOwnedPath() + navigateToRedirectTarget() helpers in
web/src/lib/auth/redirect.ts. The helper picks window.location.replace for
paths the Go server owns (/oauth/, /api/, /.well-known/, /mcp, /metrics)
and goto() for genuine SPA routes. window.location.replace matches the
prior replaceState: true semantics so back-button doesn't return to /login.

Swap all 5 post-auth call sites in login/+page.svelte (onMount, password
submit, 2FA verify) and register/+page.svelte (onMount, register submit)
to use the helper. goto import is no longer needed in either file.

2026-05-02 21:06:58 -04:00

..

lastMethod.ts

feat(web): last-used auth method banner on /login (TASK-923) (#323)

2026-04-30 17:14:56 -04:00

redirect.ts

fix(auth): full-page navigation for server-owned post-auth redirect targets (BUG-1083) (#386)

2026-05-02 21:06:58 -04:00