Fix /admin (and other routes) losing URL on page refresh#391
Open
briansmiley wants to merge 5 commits intomainfrom
Open
Fix /admin (and other routes) losing URL on page refresh#391briansmiley wants to merge 5 commits intomainfrom
briansmiley wants to merge 5 commits intomainfrom
Conversation
Add a SvelteKit param matcher that rejects reserved route names ("admin",
"login") so direct navigation to /admin works correctly instead of being
captured by the dynamic [cohort_name] route and redirected to /market.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
On full page refresh, kinde.isAuthenticated() returns false, triggering
a login redirect through Kinde. After auth completes, Kinde returns to /
which auto-redirects to /{cohort}/market, losing the original URL. Save
the intended path in sessionStorage before the login redirect and restore
it when landing back on /.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the manual sessionStorage workaround with Kinde's built-in
mechanism. The PKCE library already saves window.location.href as
appState.kindeOriginUrl when login() is called. By providing an
on_redirect_callback, we can redirect back to the original page
(e.g. /admin) after the OAuth round-trip instead of staying on /
and getting auto-redirected to /{cohort}/market.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
window.location.replace() causes a full page reload which wipes the Kinde PKCE in-memory token store, restarting the auth flow in a loop. Instead, save the pre-login path to sessionStorage in the Kinde on_redirect_callback and let the root +page.svelte restore it via goto() (client-side navigation that preserves the token store). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Enable is_dangerously_use_local_storage so the refresh token persists across page reloads. Without this, the Kinde PKCE library stores tokens only in memory, forcing a full OAuth redirect round-trip on every refresh. With persistent storage, the library silently refreshes tokens via a background API call — no redirect, no URL loss. This replaces the on_redirect_callback + sessionStorage workaround. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
briansmiley
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/admin(URL bar, reload, bookmark) would redirect to/{cohort}/marketinstead of staying on the admin page[cohort_name]dynamic route could capture "admin" as a cohort name during client-side routing. Fixed with a SvelteKit param matcher./, which then auto-redirected to/{cohort}/market. This affected all routes but was only noticeable on non-market pages like/admin. Fixed by enablingis_dangerously_use_local_storageto persist the refresh token in localStorage, so the library can silently refresh tokens on reload without a redirect.Changes
frontend/src/params/cohort.ts— new param matcher rejecting reserved names ("admin", "login")frontend/src/routes/[cohort_name=cohort]/— renamed from[cohort_name]/to apply the matcherfrontend/src/lib/auth.svelte.ts— enableis_dangerously_use_local_storageon the Kinde PKCE clientTest plan
/admin— should stay on admin page (no Kinde redirect flash)/{cohort}/market— should stay on market page/test/market— should still work🤖 Generated with Claude Code