mirror of
https://github.com/docmost/docmost.git
synced 2026-08-27 16:57:05 +08:00
Philip Okugbe
299a9ca3c8
* fix(editor): hide transclusion borders and reset spacing in read-only mode * feat(share): add full width toggle for shared pages * feat(share): support resizing sidebar on shared pages * fix: auto redirect if there is only one SSO provider. - fix tighten sso redirect - fix share tree margin * sync * package overrides
69 lines
2.2 KiB
TypeScript
69 lines
2.2 KiB
TypeScript
const APP_ROUTE = {
|
|
HOME: "/home",
|
|
SPACES: "/spaces",
|
|
FAVORITES: "/favorites",
|
|
SEARCH: "/search",
|
|
AUTH: {
|
|
LOGIN: "/login",
|
|
SIGNUP: "/signup",
|
|
SETUP: "/setup/register",
|
|
FORGOT_PASSWORD: "/forgot-password",
|
|
PASSWORD_RESET: "/password-reset",
|
|
CREATE_WORKSPACE: "/create",
|
|
SELECT_WORKSPACE: "/select",
|
|
MFA_CHALLENGE: "/login/mfa",
|
|
MFA_SETUP_REQUIRED: "/login/mfa/setup",
|
|
VERIFY_EMAIL: "/verify-email",
|
|
},
|
|
SETTINGS: {
|
|
ACCOUNT: {
|
|
PROFILE: "/settings/account/profile",
|
|
PREFERENCES: "/settings/account/preferences",
|
|
},
|
|
WORKSPACE: {
|
|
GENERAL: "/settings/workspace",
|
|
MEMBERS: "/settings/members",
|
|
GROUPS: "/settings/groups",
|
|
SPACES: "/settings/spaces",
|
|
BILLING: "/settings/billing",
|
|
SECURITY: "/settings/security",
|
|
},
|
|
},
|
|
};
|
|
|
|
export function safeRedirectPath(input: unknown): string | null {
|
|
if (typeof input !== "string") return null;
|
|
if (input.length === 0 || input.length > 2048) return null;
|
|
// Reject whitespace, backslash, and any Unicode "Other" category char
|
|
// (ASCII controls, zero-width space, BOM, bidi marks, etc).
|
|
if (/[\s\\]|\p{C}/u.test(input)) return null;
|
|
if (!input.startsWith("/") || input.startsWith("//")) return null;
|
|
if (input.toLowerCase().includes("://")) return null;
|
|
if (/^\/[a-z][a-z0-9+\-.]*:/i.test(input)) return null;
|
|
try {
|
|
const resolved = new URL(input, window.location.origin);
|
|
if (resolved.origin !== window.location.origin) return null;
|
|
return resolved.pathname + resolved.search + resolved.hash;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export function getPostLoginRedirect(): string {
|
|
const params = new URLSearchParams(window.location.search);
|
|
return safeRedirectPath(params.get("redirect")) ?? APP_ROUTE.HOME;
|
|
}
|
|
|
|
/**
|
|
* Returns the `?redirect=` value from the current URL only when it is a safe
|
|
* same-origin path. Unlike {@link getPostLoginRedirect} this returns `null`
|
|
* (not `/home`) when no redirect is present, so callers can distinguish
|
|
* "user came here directly" from "user was bounced from a deep link".
|
|
*/
|
|
export function getRedirectParam(): string | null {
|
|
const params = new URLSearchParams(window.location.search);
|
|
return safeRedirectPath(params.get("redirect"));
|
|
}
|
|
|
|
export default APP_ROUTE;
|