src/modules/navigation/PublicNoteRedirect.tsx (1)

26-60: Consider adding search to the useEffect dependency array.

The search variable is used inside the effect (line 32) but isn't listed in the dependency array. While this is likely fine since search won't change during this redirect flow, adding it would satisfy the exhaustive-deps rule and prevent potential stale closure issues if the component's usage changes.

♻️ Add search to dependencies

-  }, [fileId, driveId, client])
+  }, [fileId, driveId, client, search])

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/PublicNoteRedirect.tsx` around lines 26 - 60, The
useEffect in PublicNoteRedirect (the effect that defines fetchNoteUrl)
references the variable search but does not include it in the dependency array;
update the dependency list for that useEffect to include search (so the effect
depends on [fileId, driveId, client, search]) to satisfy exhaustive-deps and
avoid stale closures when search changes.

src/modules/shareddrives/helpers.ts (1)

43-57: Non-null assertion on file.driveId could mask runtime issues.

The function uses file.driveId! but the type IOCozyFile doesn't guarantee driveId is present. While the caller in computePath checks for driveId before calling, this function doesn't enforce that precondition.

Consider either:

1. Adding a runtime check with a descriptive error
2. Using a more specific type that guarantees driveId

🛡️ Suggested defensive check

 export const makeSharedDriveNoteReturnUrl = (
   client: CozyClient,
   file: IOCozyFile
 ): string => {
+  if (!file.driveId) {
+    throw new Error('driveId is required to generate shared drive return URL')
+  }
   return generateWebLink({
     slug: 'drive',
     searchParams: [],
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-member-access`
     cozyUrl: client.getStackClient().uri as string,
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-assignment`
     subDomainType: client.getInstanceOptions().subdomain,
     pathname: '',
-    hash: `/shareddrive/${file.driveId!}/${file.dir_id}`
+    hash: `/shareddrive/${file.driveId}/${file.dir_id}`
   })
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/shareddrives/helpers.ts` around lines 43 - 57, The helper
makeSharedDriveNoteReturnUrl is using a non-null assertion on file.driveId which
can mask runtime errors; update it to either (a) perform a runtime check at the
start of makeSharedDriveNoteReturnUrl and throw a descriptive error if
file.driveId is missing, or (b) tighten the function signature to accept a file
type that guarantees driveId (e.g., IOCozyFile & { driveId: string }) so callers
like computePath must pass a file with driveId; ensure references to
client.getStackClient(), client.getInstanceOptions(), and the hash construction
remain unchanged.

src/modules/navigation/hooks/helpers.ts (1)

120-130: Empty returnUrl parameter appended when client is null.

When driveId exists but client is null, the path becomes /note/${driveId}/${file._id}?returnUrl= with an empty value. Consider omitting the query parameter entirely when returnUrl is empty to produce cleaner URLs.

♻️ Cleaner URL when returnUrl is empty

     case 'public-note':
       if (driveId) {
         const returnUrl = client
           ? makeSharedDriveNoteReturnUrl(client, file as IOCozyFile)
           : ''

-        return `/note/${driveId}/${file._id}?returnUrl=${encodeURIComponent(
-          returnUrl
-        )}`
+        const basePath = `/note/${driveId}/${file._id}`
+        return returnUrl
+          ? `${basePath}?returnUrl=${encodeURIComponent(returnUrl)}`
+          : basePath
       } else {
         return `/note/${file._id}`
       }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/hooks/helpers.ts` around lines 120 - 130, The
generated URL includes an empty returnUrl query when client is null; in the
block that constructs the shared-drive note path (inside
src/modules/navigation/hooks/helpers.ts around the code using driveId, file._id
and makeSharedDriveNoteReturnUrl), only append "?returnUrl=..." when returnUrl
is non-empty/truthy — i.e., compute returnUrl with
makeSharedDriveNoteReturnUrl(client, file) and then branch to return
`/note/${driveId}/${file._id}` if returnUrl is falsy, otherwise return
`/note/${driveId}/${file._id}?returnUrl=${encodeURIComponent(returnUrl)}` so no
empty query parameter is emitted.

src/modules/shareddrives/helpers.ts (1)

43-57: ⚠️ Potential issue | 🟡 Minor

Validate driveId and dir_id before constructing the URL.

Both file.driveId and file.dir_id are used without validation. While driveId uses a non-null assertion (!), and the caller in computePath checks for driveId, dir_id could still be undefined (e.g., for root-level items), resulting in a malformed URL containing the literal string "undefined".

🛡️ Add validation for both properties

 export const makeSharedDriveNoteReturnUrl = (
   client: CozyClient,
   file: IOCozyFile
 ): string => {
+  if (!file.driveId || !file.dir_id) {
+    throw new Error('driveId and dir_id are required to generate shared drive return URL')
+  }
   return generateWebLink({
     slug: 'drive',
     searchParams: [],
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-member-access`
     cozyUrl: client.getStackClient().uri as string,
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-assignment`
     subDomainType: client.getInstanceOptions().subdomain,
     pathname: '',
-    hash: `/shareddrive/${file.driveId!}/${file.dir_id}`
+    hash: `/shareddrive/${file.driveId}/${file.dir_id}`
   })
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/shareddrives/helpers.ts` around lines 43 - 57, In
makeSharedDriveNoteReturnUrl validate that file.driveId and file.dir_id are
defined before building the hash: if driveId is missing throw/return an explicit
error (do not rely on the non-null assertion), and for dir_id handle root-level
items by using an explicit fallback (e.g. empty string or a canonical "root"
token) so the generated hash never contains the literal "undefined"; update the
hash construction (inside generateWebLink call in makeSharedDriveNoteReturnUrl)
to use the validated driveId and a safe dirId fallback.

src/modules/navigation/PublicNoteRedirect.tsx (1)

32-33: Consider validating returnUrl before passing to fetchURL to prevent potential open redirect vulnerabilities.

Although returnUrl typically originates from the controlled makeSharedDriveNoteReturnUrl() function, it's extracted directly from URL search parameters which users can modify. The parameter is passed to fetchURL without validation. Consider adding a check to ensure returnUrl points to a legitimate Cozy instance before passing it along.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/PublicNoteRedirect.tsx` around lines 32 - 33, Validate
the extracted returnUrl from searchParams before passing it to fetchURL in
PublicNoteRedirect: parse returnUrl using the URL constructor (or a safe
parser), ensure its origin/host matches an allowed Cozy instance pattern (e.g.,
exact trusted host(s), allowed host suffix, or match window.location.origin if
appropriate), and only call fetchURL(returnUrl) when the check passes; otherwise
fall back to a safe internal URL or abort the redirect. Update the logic around
searchParams/returnUrl and any call sites of fetchURL to perform this validation
so untrusted user-supplied returnUrl values cannot trigger open redirects.

src/modules/navigation/hooks/helpers.ts (1)

120-130: ⚠️ Potential issue | 🟡 Minor

Empty returnUrl query parameter when client is null.

When driveId exists but client is null, the code appends an empty returnUrl parameter (e.g., /note/drive456/note123?returnUrl=). This could cause issues in the notes app when parsing the URL.

Consider only appending the parameter when returnUrl has a value:

🔧 Conditionally append returnUrl

     case 'public-note':
       if (driveId) {
         const returnUrl = client
           ? makeSharedDriveNoteReturnUrl(client, file as IOCozyFile)
           : ''

-        return `/note/${driveId}/${file._id}?returnUrl=${encodeURIComponent(
-          returnUrl
-        )}`
+        const basePath = `/note/${driveId}/${file._id}`
+        return returnUrl
+          ? `${basePath}?returnUrl=${encodeURIComponent(returnUrl)}`
+          : basePath
       } else {
         return `/note/${file._id}`
       }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/hooks/helpers.ts` around lines 120 - 130, The code
builds a note URL that includes a returnUrl query param even when client is
null, producing an empty `returnUrl=`; update the logic in the block that checks
`driveId` (the function using `driveId`, `client`,
`makeSharedDriveNoteReturnUrl`, and `file._id`) to only append `?returnUrl=...`
when `returnUrl` is non-empty: compute `returnUrl` via
`makeSharedDriveNoteReturnUrl(client, file)` only if `client` is truthy, then
conditionally add the `?returnUrl=encodeURIComponent(returnUrl)` suffix to
`/note/${driveId}/${file._id}` only when `returnUrl` has a value; otherwise
return the base `/note/${driveId}/${file._id}` without any empty query
parameter.

src/modules/shareddrives/helpers.ts (1)

43-57: ⚠️ Potential issue | 🟡 Minor

Validate driveId and dir_id before use to prevent malformed URLs.

The static analysis flagged the non-null assertion on file.driveId! (line 55). While the caller in computePath checks for driveId existence, dir_id could still be undefined for root-level items, resulting in a URL containing the literal string "undefined".

Consider adding validation at the function boundary for defensive programming:

🛡️ Proposed fix with validation

 export const makeSharedDriveNoteReturnUrl = (
   client: CozyClient,
   file: IOCozyFile
 ): string => {
+  if (!file.driveId || !file.dir_id) {
+    throw new Error('driveId and dir_id are required to generate shared drive return URL')
+  }
   return generateWebLink({
     slug: 'drive',
     searchParams: [],
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-member-access`
     cozyUrl: client.getStackClient().uri as string,
     // eslint-disable-next-line `@typescript-eslint/no-unsafe-assignment`
     subDomainType: client.getInstanceOptions().subdomain,
     pathname: '',
-    hash: `/shareddrive/${file.driveId!}/${file.dir_id}`
+    hash: `/shareddrive/${file.driveId}/${file.dir_id}`
   })
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/shareddrives/helpers.ts` around lines 43 - 57, The
makeSharedDriveNoteReturnUrl function uses file.driveId! and file.dir_id
directly, which can produce malformed URLs if either is undefined; update this
function to validate file.driveId and file.dir_id at the start (e.g., if
(!file.driveId || !file.dir_id) throw a descriptive Error or normalize dir_id to
''/root as appropriate for your app), remove the non-null assertion on
file.driveId, and then build the hash using the validated/normalized values when
calling generateWebLink so the URL never contains the literal "undefined".

src/modules/navigation/hooks/helpers.spec.js (1)

237-242: Consider adding test coverage for the case when client is provided.

This test validates the behavior when client is not provided (empty returnUrl). Adding a test case that mocks a CozyClient and verifies the actual return URL generation would improve coverage of the happy path.

💡 Suggested additional test case

it('should return correct path for public-note with driveId and client', () => {
  const file = { _id: 'note123', driveId: 'drive456', dir_id: 'folder789' }
  const mockClient = {
    getStackClient: () => ({ uri: 'https://example.mycozy.cloud' }),
    getInstanceOptions: () => ({ subdomain: 'nested' })
  }
  const result = computePath(file, {
    type: 'public-note',
    pathname: '/public',
    client: mockClient
  })
  expect(result).toMatch(/^\/note\/drive456\/note123\?returnUrl=/)
  expect(result).toContain(encodeURIComponent('https://'))
})

Note: You may need to mock generateWebLink from cozy-client for this test to work properly.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/hooks/helpers.spec.js` around lines 237 - 242, Add a
unit test that exercises computePath when a CozyClient-like `client` is
provided: create a file object with _id, driveId (and optional dir_id), mock a
client exposing getStackClient and getInstanceOptions (or stub generateWebLink
from cozy-client), call computePath(file, { type: 'public-note', pathname:
'/public', client: mockClient }) and assert the returned path still matches the
/note/:driveId/:id?returnUrl=... pattern and that the query contains a non-empty
encoded returnUrl (e.g., contains "https://" when decoded or contains
encodeURIComponent('https://')), ensuring the test covers the happy path with
client present; use the same test file and helper names (computePath,
generateWebLink) to locate code.

src/modules/navigation/hooks/helpers.ts (1)

120-127: ⚠️ Potential issue | 🟡 Minor

Avoid emitting an empty returnUrl query param

When client is null, this still generates ?returnUrl=. Build the base note URL first, and only append returnUrl when it is non-empty.

Suggested fix

     case 'public-note':
       if (driveId) {
         const returnUrl = client
           ? makeSharedDriveNoteReturnUrl(client, file as IOCozyFile)
           : ''

-        return `/note/${driveId}/${file._id}?returnUrl=${encodeURIComponent(
-          returnUrl
-        )}`
+        const basePath = `/note/${driveId}/${file._id}`
+        return returnUrl
+          ? `${basePath}?returnUrl=${encodeURIComponent(returnUrl)}`
+          : basePath
       } else {
         return `/note/${file._id}`
       }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/modules/navigation/hooks/helpers.ts` around lines 120 - 127, The URL
builder emits an empty returnUrl query param when client is null; update the
logic in the block that uses driveId, file, and makeSharedDriveNoteReturnUrl so
you first construct the base path `/note/${driveId}/${file._id}` and then, only
if client is truthy and makeSharedDriveNoteReturnUrl(client, file as IOCozyFile)
returns a non-empty string, append
`?returnUrl=${encodeURIComponent(returnUrl)}`; ensure you do not append
`?returnUrl=` when returnUrl is empty.