v0.12.0

Sign-in can now bring you back to where you started.

Sign-in return

A visitor who clicked something, signed in, and landed on their files had been dropped: whatever they were part way through was gone. Sign-in now takes an optional return_to, and after the emailed link is consumed that is where they land. The existing intent=send behaviour still decides when there is no return_to.

It rides on the login token rather than the session, because sign-in resets the session and the link is often opened on a different device from the one that asked for it.

Only a path on this site is accepted, checked where it enters and again before it is stored, so it cannot become an open redirect. Anything else is dropped and the visitor lands on their files.

after_sign_in_path(intent:, return_to:) on the Authentication concern is the single answer to where somebody lands, used by both the sign-in form and the emailed link.

Also since 0.11.1

The npm advisories audit no longer fails the build when the registry cannot answer. bin/importmap-audit tolerates every Importmap::Npm::HTTPError and still fails on a real advisory.

Migrations

One, adding a nullable return_to column to login_tokens.