first commit

app/middleware/auth.global.js

@@ -0,0 +1,53 @@
+import { defineNuxtRouteMiddleware, navigateTo } from "#app";
+import { useAuth } from "~/lib/auth.js";
+import { r as safeRedirect } from "~/lib/auth-redirect.js";
+import { isAuthPage, isPublicRoute } from "~/utils/access.js";
+
+export default defineNuxtRouteMiddleware((to) => {
+  const auth = useAuth();
+  if (to.path === "/home.htm") {
+    if (Object.hasOwn(to.query, "queryParam") || !auth.legacyLoginPending) {
+      auth.prepareLegacyLogin(to.query.queryParam);
+    }
+    if (Object.hasOwn(to.query, "queryParam")) {
+      const url = new URL(window.location.href);
+      url.searchParams.delete("queryParam");
+      window.history.replaceState(
+        window.history.state,
+        "",
+        url.pathname + url.search + url.hash,
+      );
+      const query = { ...to.query };
+      delete query.queryParam;
+      // Canonicalize the router location too; mutating query alone leaves fullPath with the credential.
+      return navigateTo(
+        { path: "/home.htm", query, hash: to.hash },
+        { replace: true },
+      );
+    }
+    return;
+  }
+  if (!auth.isLoggedIn && !isPublicRoute(to)) {
+    const query = { ...to.query };
+    delete query.queryParam;
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+      for (const item of Array.isArray(value) ? value : [value])
+        if (item != null) params.append(key, item);
+    }
+    const redirect = safeRedirect(
+      to.path + (params.size ? "?" + params : "") + to.hash,
+    );
+    return navigateTo({
+      path: "/login",
+      query: redirect === "/" ? {} : { redirect },
+    });
+  }
+  if (
+    auth.isLoggedIn &&
+    isAuthPage(to.path) &&
+    !["/oauth/callback", "/official-site"].includes(to.path) &&
+    !(to.path === "/oauth/bind" && to.query.provider === "wechat")
+  )
+    return navigateTo("/");
+});