[malkoG]

Summary

• Implement returnTo redirect flow across all auth providers (OTP, Mastodon OAuth, Misskey MiAuth, HackersPub GraphQL) so users return to their original page after signing in instead of always landing on /
• Store returnTo in each provider's in-memory session store to persist it across the external OAuth redirect cycle, with sanitizeReturnTo utility to prevent open redirect attacks
• Use beforeLoad server-side auth check to immediately redirect already-signed-in users away from the sign-in page, avoiding React hooks violations

Fixes #156

Test plan

• Visit an event page while logged out, click "Sign in to RSVP" — verify URL includes returnTo param
• Complete sign-in via OTP — verify redirect back to event registration page
• Complete sign-in via Mastodon OAuth — verify redirect back to event registration page
• Visit /auth/signin while already logged in — verify immediate redirect to /
• Visit /auth/signin?returnTo=/settings while already logged in — verify immediate redirect to /settings
• Visit /settings, /calendar, /groups/create, /events/create while logged out — verify returnTo is passed and works after sign-in

Summary by CodeRabbit

• New Features
  • Added return-to redirect functionality: after signing in, users are now returned to the page they were visiting instead of always going to the home page
  • Enhanced sign-in flows for all authentication providers to preserve and respect the user's intended destination

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 451dd628-440b-4937-ab8f-513faf0a6eca

📥 Commits

Reviewing files that changed from the base of the PR and between 09fe91e and ae7adaf.

📒 Files selected for processing (21)

• src/lib/return-to.ts
• src/routes/auth/hackerspub/-graphql-callback-api.ts
• src/routes/auth/hackerspub/-graphql-callback.ts
• src/routes/auth/hackerspub/-graphql-start.ts
• src/routes/auth/mastodon/-oauth-callback-api.ts
• src/routes/auth/mastodon/-oauth-callback.ts
• src/routes/auth/mastodon/-oauth-start.ts
• src/routes/auth/misskey/-miauth-callback-api.ts
• src/routes/auth/misskey/-miauth-callback.ts
• src/routes/auth/misskey/-miauth-start.ts
• src/routes/auth/signin.tsx
• src/routes/calendar/index.tsx
• src/routes/events/$eventId/index.tsx
• src/routes/events/$eventId/register.tsx
• src/routes/events/create.tsx
• src/routes/groups/create.tsx
• src/routes/groups/my.tsx
• src/routes/settings/index.tsx
• src/server/hackerspub-sessions.ts
• src/server/mastodon-oauth-sessions.ts
• src/server/miauth-sessions.ts

---

📝 Walkthrough

Walkthrough

This pull request implements a redirect-back-to-source feature across the authentication system. A new sanitizeReturnTo() utility validates return paths, while all auth providers (Mastodon OAuth, Misskey MiAuth, HackersPub GraphQL, OTP) are updated to accept, store, and return optional returnTo parameters. Protected routes and the sign-in flow now thread this parameter through the authentication chain to redirect users back to their original destination after sign-in completion.

Changes

Cohort / File(s)	Summary
Return-to Utility src/lib/return-to.ts	New sanitizeReturnTo() function validates return paths, accepting only strings starting with single / (rejecting // and backslashes), defaulting to "/" for null/undefined/non-string inputs.
HackersPub Session Management src/server/hackerspub-sessions.ts	Extended HackersPubSession interface and createHackersPubSession() to accept optional returnTo parameter; verifyAndConsumeHackersPubSession() now returns returnTo in result object.
HackersPub Auth Flow src/routes/auth/hackerspub/-graphql-start.ts, src/routes/auth/hackerspub/-graphql-callback.ts, src/routes/auth/hackerspub/-graphql-callback-api.ts	All three handlers updated to accept, store, and return returnTo; callback validates return path before redirecting.
Mastodon OAuth Session Management src/server/mastodon-oauth-sessions.ts	Extended MastodonOAuthSession and createOAuthSession() to accept optional returnTo parameter and persist it on session object.
Mastodon OAuth Flow src/routes/auth/mastodon/-oauth-start.ts, src/routes/auth/mastodon/-oauth-callback.ts, src/routes/auth/mastodon/-oauth-callback-api.ts	All three handlers updated to accept, store, and return returnTo; callback validates relative path before redirecting.
MiAuth Session Management src/server/miauth-sessions.ts	Extended MiAuthSession, updated createMiAuthSession() to accept optional returnTo, and verifyAndConsumeMiAuthSession() to return returnTo in result.
MiAuth Flow src/routes/auth/misskey/-miauth-start.ts, src/routes/auth/misskey/-miauth-callback.ts, src/routes/auth/misskey/-miauth-callback-api.ts	All three handlers updated to accept, store, and return returnTo; callback validates relative path before redirecting.
Sign-in Flow src/routes/auth/signin.tsx	Added server-side pre-check for already-signed-in users (redirect to sanitized returnTo); extended route search validation to accept returnTo query parameter; updated AuthProviderDef to accept returnTo prop; wired returnTo through all provider dialogs; changed post-OTP redirect to use sanitized returnTo.
Protected Routes — Return-to Integration src/routes/calendar/index.tsx, src/routes/settings/index.tsx, src/routes/events/$eventId/index.tsx, src/routes/events/$eventId/register.tsx, src/routes/events/create.tsx, src/routes/groups/create.tsx, src/routes/groups/my.tsx	Updated 401/unauthenticated redirect logic to include returnTo query parameter pointing to the current page when navigating to /auth/signin.

Sequence Diagram

sequenceDiagram
    participant User as User/Client
    participant App as App Route
    participant SignIn as Auth Sign-in
    participant Provider as Auth Provider<br/>(OAuth/MiAuth)
    participant SessionStore as Session Store
    participant Callback as Callback Handler

    User->>App: Request resource (e.g., /events/123)
    App->>SignIn: Redirect with returnTo=/events/123
    SignIn->>SessionStore: Store returnTo in auth session
    SignIn->>Provider: Initiate auth with returnTo param
    Provider->>User: Redirect to external auth
    User->>Provider: Authenticate
    Provider->>Callback: Redirect to callback with auth code
    Callback->>SessionStore: Verify auth & retrieve returnTo
    SessionStore->>Callback: Return auth data + returnTo
    Callback->>User: Redirect to returnTo (validated)
    User->>App: Load resource (back at original page)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Add Hackers' Pub GraphQL authentication provider #155: Implements HackersPub auth flow which this PR extends by adding returnTo parameter threading through the same session and callback handlers.
• add: miauth support for misskey-based instance #139: Adds MiAuth/Misskey auth flow; this PR extends that implementation with returnTo support across session creation, verification, and callback stages.

Poem

🐰 A rabbit hops through auth gates with glee,
Storing returnTo in session so free,
After sign-in's done, it bounces back fast,
To the page where it started at last!
No more lost users in redirect's long maze,
Just happy returns through authentication's haze! 🌟

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/redirection-after-signin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}