From 68f36dbf0cff77f7f570d0c04bd9f1b1769f347d Mon Sep 17 00:00:00 2001
From: Christian Beutel <>
Date: Thu, 10 Jul 2025 15:29:07 +0200
Subject: [PATCH] allow external URLs in private instances

---
 web/src/hooks.server.ts                |  2 +-
 web/src/lib/util/authorization_util.ts | 14 +++++++++++++-
 web/src/routes/+layout.svelte          |  2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/web/src/hooks.server.ts b/web/src/hooks.server.ts
index fedc15d4..d7cf6c8c 100644
--- a/web/src/hooks.server.ts
+++ b/web/src/hooks.server.ts
@@ -58,7 +58,7 @@ const auth: Handle = async ({ event, resolve }) => {
 
 
   // validate the user existence and if the path is acceesible
-  if (!pb.authStore.record && isRouteProtected(url.pathname)) {
+  if (!pb.authStore.record && isRouteProtected(url)) {
     throw redirect(302, '/login?r=' + url.pathname);
   } else if (pb.authStore.record && url.pathname === "/login") {
     throw redirect(302, '/');
diff --git a/web/src/lib/util/authorization_util.ts b/web/src/lib/util/authorization_util.ts
index a40efbbd..830ab049 100644
--- a/web/src/lib/util/authorization_util.ts
+++ b/web/src/lib/util/authorization_util.ts
@@ -1,3 +1,4 @@
+import { browser } from "$app/environment";
 import { env } from "$env/dynamic/public";
 
 const privateRoutes = [
@@ -12,12 +13,23 @@ const publicRoutes = [
   "/api/v1/auth",
   "/api/v1/user",
   "/api/v1/category",
+  "/api/v1/auth/oauth",
   "/register",
   "/auth"
 
 ]
 
-export function isRouteProtected(path: string) {
+export function isRouteProtected(url: URL | undefined) {
+
+  if (url === undefined) {
+    return false;
+  }
+
+  if (browser && url.hostname !== window.location.hostname) {
+    return false;
+  }
+
+  const path = url.pathname
 
   if (env.PUBLIC_PRIVATE_INSTANCE == "true") {
     return !publicRoutes.some(allowedPath =>
diff --git a/web/src/routes/+layout.svelte b/web/src/routes/+layout.svelte
index e290279b..dca18025 100644
--- a/web/src/routes/+layout.svelte
+++ b/web/src/routes/+layout.svelte
@@ -29,7 +29,7 @@
     let { data, children }: Props = $props();
     
     beforeNavigate((n) => {
-        if (!$currentUser && isRouteProtected(n.to?.url?.pathname ?? "")) {
+        if (!$currentUser && isRouteProtected(n.to?.url)) {
             n.cancel();
             goto("/login?r=" + n.to?.url?.pathname);
         }