allow external URLs in private instances

web/src/hooks.server.ts

@@ -58,7 +58,7 @@ const auth: Handle = async ({ event, resolve }) => {
 
 
   // validate the user existence and if the path is acceesible
-  if (!pb.authStore.record && isRouteProtected(url.pathname)) {
+  if (!pb.authStore.record && isRouteProtected(url)) {
     throw redirect(302, '/login?r=' + url.pathname);
   } else if (pb.authStore.record && url.pathname === "/login") {
     throw redirect(302, '/');

web/src/lib/util/authorization_util.ts

@@ -1,3 +1,4 @@
+import { browser } from "$app/environment";
 import { env } from "$env/dynamic/public";
 
 const privateRoutes = [
@@ -12,12 +13,23 @@ const publicRoutes = [
   "/api/v1/auth",
   "/api/v1/user",
   "/api/v1/category",
+  "/api/v1/auth/oauth",
   "/register",
   "/auth"
 
 ]
 
-export function isRouteProtected(path: string) {
+export function isRouteProtected(url: URL | undefined) {
+
+  if (url === undefined) {
+    return false;
+  }
+
+  if (browser && url.hostname !== window.location.hostname) {
+    return false;
+  }
+
+  const path = url.pathname
 
   if (env.PUBLIC_PRIVATE_INSTANCE == "true") {
     return !publicRoutes.some(allowedPath =>

web/src/routes/+layout.svelte

@@ -29,7 +29,7 @@
     let { data, children }: Props = $props();
     
     beforeNavigate((n) => {
-        if (!$currentUser && isRouteProtected(n.to?.url?.pathname ?? "")) {
+        if (!$currentUser && isRouteProtected(n.to?.url)) {
             n.cancel();
             goto("/login?r=" + n.to?.url?.pathname);
         }