dhkatzandClaude Opus 5.5
64c552330b
apps/web: Next.js 16 (App Router), Tailwind 4 and shadcn/ui, light and dark from the system. Pages render on the server and call the API with Eden Treaty (typed by @t5de/api), forwarding the visitor's cookie; forms use server actions; sign-up, sign-in and sign-out use Better Auth's React client. /api is rewritten to the API so its cookies are first-party. Who's online follows the API's event stream (Next's gzip is off: it held the stream back). Standalone output with a Dockerfile; deploys to Vercel as is. Co-Authored-By: Claude Opus 5.5 <[email protected]>
7 lines
361 B
TypeScript
7 lines
361 B
TypeScript
/** next if it's a path on this site, else fallback (so ?next= can't send people elsewhere). */
|
|
export function safeNext(next: string | string[] | undefined | null, fallback = "/account"): string {
|
|
if (typeof next !== "string") return fallback;
|
|
if (!next.startsWith("/") || next.startsWith("//") || next.startsWith("/\\")) return fallback;
|
|
return next;
|
|
}
|