From 9ee7fbb3a7f8f6e909e3210061673261a4b04100 Mon Sep 17 00:00:00 2001
From: NandkishorJadoun <183695114+NandkishorJadoun@users.noreply.github.com>
Date: Wed, 4 Feb 2026 09:09:40 +0530
Subject: [PATCH 1/9] fix: horizontal scrolling on pakage docs pages

---
 app/pages/package-docs/[...path].vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/pages/package-docs/[...path].vue b/app/pages/package-docs/[...path].vue
index eb3b86279..76afa8137 100644
--- a/app/pages/package-docs/[...path].vue
+++ b/app/pages/package-docs/[...path].vue
@@ -253,6 +253,7 @@ const showEmptyState = computed(() => docsData.value?.status !== 'ok')
 /* Individual symbol articles */
 .docs-content .docs-symbol {
   @apply mb-10 pb-10 border-b border-border/30 last:border-0;
+  word-break: break-word;
 }
 
 .docs-content .docs-symbol:target {

From 42af988184a84aaafec424ac6c22de0edf1d0d7d Mon Sep 17 00:00:00 2001
From: NandkishorJadoun <183695114+NandkishorJadoun@users.noreply.github.com>
Date: Wed, 4 Feb 2026 16:54:25 +0530
Subject: [PATCH 2/9] feat: add page path to query

---
 app/components/Header/AuthModal.client.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/components/Header/AuthModal.client.vue b/app/components/Header/AuthModal.client.vue
index ada2811f9..0a2dacb8f 100644
--- a/app/components/Header/AuthModal.client.vue
+++ b/app/components/Header/AuthModal.client.vue
@@ -1,13 +1,13 @@
 <script setup lang="ts">
 const handleInput = shallowRef('')
-
+const route = useRoute()
 const { user, logout } = useAtproto()
 
 async function handleBlueskySignIn() {
   await navigateTo(
     {
       path: '/api/auth/atproto',
-      query: { handle: 'https://bsky.social' },
+      query: { handle: 'https://bsky.social', returnTo: route.fullPath },
     },
     { external: true },
   )
@@ -17,7 +17,7 @@ async function handleCreateAccount() {
   await navigateTo(
     {
       path: '/api/auth/atproto',
-      query: { handle: 'https://npmx.social', create: 'true' },
+      query: { handle: 'https://npmx.social', create: 'true', returnTo: route.fullPath },
     },
     { external: true },
   )

From 79b63b6e6d4286ffcd7325e04cd94479b3a45e4b Mon Sep 17 00:00:00 2001
From: NandkishorJadoun <183695114+NandkishorJadoun@users.noreply.github.com>
Date: Wed, 4 Feb 2026 16:57:44 +0530
Subject: [PATCH 3/9] feat: implement cookie-based returnTo redirect for OAuth
 flow

---
 server/api/auth/atproto.get.ts | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index 287823ce7..7d13d7fc5 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -15,6 +15,15 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
+  const returnTo = query.returnTo?.toString() || '/'
+
+  setCookie(event, 'auth_return_to', returnTo, {
+    maxAge: 60 * 5,
+    httpOnly: true,
+    // secure only if NOT in dev mode
+    secure: !import.meta.dev,
+  })
+
   const clientMetadata = getOauthClientMetadata()
   const { stateStore, sessionStore } = useOAuthStorage(event)
 
@@ -60,5 +69,8 @@ export default defineEventHandler(async event => {
 
   await session.update(miniDoc)
 
-  return sendRedirect(event, '/')
+  const returnToURL = getCookie(event, 'auth_return_to') || '/'
+  deleteCookie(event, 'auth_return_to')
+
+  return sendRedirect(event, returnToURL)
 })

From 6a5bb3bc31f839b2b5d6ce2e17d4b16d3c2ac5de Mon Sep 17 00:00:00 2001
From: Nandkishor Jadoun <183695114+NandkishorJadoun@users.noreply.github.com>
Date: Wed, 4 Feb 2026 17:30:30 +0530
Subject: [PATCH 4/9] Apply suggestion from @coderabbitai[bot]

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 server/api/auth/atproto.get.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index 7d13d7fc5..91b47910c 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -15,7 +15,10 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
-  const returnTo = query.returnTo?.toString() || '/'
+  const rawReturnTo = query.returnTo?.toString() || '/'
+  // Validate returnTo is a safe relative path (prevent open redirect)
+  const isRelativePath = rawReturnTo.startsWith('/') && !rawReturnTo.startsWith('//') && !rawReturnTo.includes(':')
+  const returnTo = isRelativePath ? rawReturnTo : '/'
 
   setCookie(event, 'auth_return_to', returnTo, {
     maxAge: 60 * 5,

From e4268eefb12722c7cc70f8567436bd05c9de73db Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Wed, 4 Feb 2026 12:17:17 +0000
Subject: [PATCH 5/9] chore: remove style change

---
 app/pages/package-docs/[...path].vue | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/pages/package-docs/[...path].vue b/app/pages/package-docs/[...path].vue
index 76afa8137..eb3b86279 100644
--- a/app/pages/package-docs/[...path].vue
+++ b/app/pages/package-docs/[...path].vue
@@ -253,7 +253,6 @@ const showEmptyState = computed(() => docsData.value?.status !== 'ok')
 /* Individual symbol articles */
 .docs-content .docs-symbol {
   @apply mb-10 pb-10 border-b border-border/30 last:border-0;
-  word-break: break-word;
 }
 
 .docs-content .docs-symbol:target {

From 6ed842aa07704ff1da44dfe5c36ff83fe128530d Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 12:33:06 +0000
Subject: [PATCH 6/9] [autofix.ci] apply automated fixes

---
 server/api/auth/atproto.get.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index 681d01e59..3a330e70f 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -19,7 +19,8 @@ export default defineEventHandler(async event => {
   const query = getQuery(event)
   const rawReturnTo = query.returnTo?.toString() || '/'
   // Validate returnTo is a safe relative path (prevent open redirect)
-  const isRelativePath = rawReturnTo.startsWith('/') && !rawReturnTo.startsWith('//') && !rawReturnTo.includes(':')
+  const isRelativePath =
+    rawReturnTo.startsWith('/') && !rawReturnTo.startsWith('//') && !rawReturnTo.includes(':')
   const returnTo = isRelativePath ? rawReturnTo : '/'
 
   setCookie(event, 'auth_return_to', returnTo, {

From 20a91e60a555a371cace840d71246c243ae9ac39 Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Thu, 5 Feb 2026 13:24:16 +0000
Subject: [PATCH 7/9] fix: use URL to validate safe URL

---
 server/api/auth/atproto.get.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index fbcfdd5c1..fc972efc6 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -10,6 +10,8 @@ import { handleResolver } from '#server/utils/atproto/oauth'
 import { Client } from '@atproto/lex'
 import * as app from '#shared/types/lexicons/app'
 import { ensureValidAtIdentifier } from '@atproto/syntax'
+// @ts-expect-error virtual file from oauth module
+import { clientUri } from '#oauth/config'
 
 /**
  * Fetch the user's profile record to get their avatar blob reference
@@ -53,13 +55,11 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
-  const rawReturnTo = query.returnTo?.toString() || '/'
   // Validate returnTo is a safe relative path (prevent open redirect)
-  const isRelativePath =
-    rawReturnTo.startsWith('/') && !rawReturnTo.startsWith('//') && !rawReturnTo.includes(':')
-  const returnTo = isRelativePath ? rawReturnTo : '/'
+  const newURL = new URL(query.returnTo?.toString() || '/', clientUri)
+  const redirectPath = newURL.origin === clientUri ? newURL.pathname : '/'
 
-  setCookie(event, 'auth_return_to', returnTo, {
+  setCookie(event, 'auth_return_to', redirectPath, {
     maxAge: 60 * 5,
     httpOnly: true,
     // secure only if NOT in dev mode

From 05e5eb0bc0a99759de7876aa0dfade73ca5e6996 Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Thu, 5 Feb 2026 13:27:12 +0000
Subject: [PATCH 8/9] fix: use authRedirect

---
 app/components/Header/AuthModal.client.vue | 16 ++--------------
 app/utils/atproto/helpers.ts               | 12 ++++++++++--
 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/app/components/Header/AuthModal.client.vue b/app/components/Header/AuthModal.client.vue
index e42d64ba0..806fd9f14 100644
--- a/app/components/Header/AuthModal.client.vue
+++ b/app/components/Header/AuthModal.client.vue
@@ -7,23 +7,11 @@ const route = useRoute()
 const { user, logout } = useAtproto()
 
 async function handleBlueskySignIn() {
-  await navigateTo(
-    {
-      path: '/api/auth/atproto',
-      query: { handle: 'https://bsky.social', returnTo: route.fullPath },
-    },
-    { external: true },
-  )
+  await authRedirect('https://bsky.social', { redirectTo: route.fullPath })
 }
 
 async function handleCreateAccount() {
-  await navigateTo(
-    {
-      path: '/api/auth/atproto',
-      query: { handle: 'https://npmx.social', create: 'true', returnTo: route.fullPath },
-    },
-    { external: true },
-  )
+  await authRedirect('https://npmx.social', { create: true, redirectTo: route.fullPath })
 }
 
 async function handleLogin() {
diff --git a/app/utils/atproto/helpers.ts b/app/utils/atproto/helpers.ts
index 9166cef1e..dd4693a64 100644
--- a/app/utils/atproto/helpers.ts
+++ b/app/utils/atproto/helpers.ts
@@ -1,14 +1,22 @@
 import type { FetchError } from 'ofetch'
 import type { LocationQueryRaw } from 'vue-router'
 
+interface AuthRedirectOptions {
+  create?: boolean
+  redirectTo?: string
+}
+
 /**
  * Redirect user to ATProto authentication
  */
-export async function authRedirect(identifier: string, create: boolean = false) {
+export async function authRedirect(identifier: string, options: AuthRedirectOptions = {}) {
   let query: LocationQueryRaw = { handle: identifier }
-  if (create) {
+  if (options.create) {
     query = { ...query, create: 'true' }
   }
+  if (options.redirectTo) {
+    query = { ...query, returnTo: options.redirectTo }
+  }
   await navigateTo(
     {
       path: '/api/auth/atproto',

From 81dc127c51ef2b9e91a27897494e6f3cc7f073cb Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Thu, 5 Feb 2026 13:36:19 +0000
Subject: [PATCH 9/9] fix: only set cookie if there's no code

---
 server/api/auth/atproto.get.ts | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index fc972efc6..cfd76b4ec 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -55,17 +55,6 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
-  // Validate returnTo is a safe relative path (prevent open redirect)
-  const newURL = new URL(query.returnTo?.toString() || '/', clientUri)
-  const redirectPath = newURL.origin === clientUri ? newURL.pathname : '/'
-
-  setCookie(event, 'auth_return_to', redirectPath, {
-    maxAge: 60 * 5,
-    httpOnly: true,
-    // secure only if NOT in dev mode
-    secure: !import.meta.dev,
-  })
-
   const clientMetadata = getOauthClientMetadata()
   const session = await useServerSession(event)
   const { stateStore, sessionStore } = useOAuthStorage(session)
@@ -79,6 +68,25 @@ export default defineEventHandler(async event => {
   })
 
   if (!query.code) {
+    // Validate returnTo is a safe relative path (prevent open redirect)
+    // Only set cookie on initial auth request, not the callback
+    let redirectPath = '/'
+    try {
+      const clientOrigin = new URL(clientUri).origin
+      const returnToUrl = new URL(query.returnTo?.toString() || '/', clientUri)
+      if (returnToUrl.origin === clientOrigin) {
+        redirectPath = returnToUrl.pathname + returnToUrl.search + returnToUrl.hash
+      }
+    } catch {
+      // Invalid URL, fall back to root
+    }
+
+    setCookie(event, 'auth_return_to', redirectPath, {
+      maxAge: 60 * 5,
+      httpOnly: true,
+      // secure only if NOT in dev mode
+      secure: !import.meta.dev,
+    })
     try {
       const handle = query.handle?.toString()
       const create = query.create?.toString()