fix(auth): resolve redirect loop on index and double encoding issue (#325)

Detailed analysis: 401 error in handleAuthFailure was forcing redirect even on public routes. Also cleaned up redundant encodeURIComponent in proxy.ts.

Author: xun082

apps/DocFlow/src/proxy.ts

@@ -6,26 +6,21 @@ import { ROUTES } from '@/utils/constants/routes';
 // Constants
 // ============================================================================
 
-/**
- * 认证相关的 Cookie 键名
- */
 const AUTH_COOKIES = {
   TOKEN: 'auth_token',
-  REFRESH_TOKEN: 'refresh_token',
   EXPIRES_IN: 'expires_in',
-  REFRESH_EXPIRES_IN: 'refresh_expires_in',
   TIMESTAMP: 'auth_timestamp',
 } as const;
 
-/**
- * 默认的 token 过期时间（7天，单位：毫秒）
- */
 const DEFAULT_TOKEN_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000;
 
+const INVALID_TOKEN_VALUES = new Set(['undefined', 'null', '']);
+
 /**
- * 无效的 token 字符串值
+ * Public routes that never require authentication.
+ * Proxy will always allow access to these paths.
  */
-const INVALID_TOKEN_VALUES = new Set(['undefined', 'null', '']);
+const PUBLIC_ROUTES = new Set([ROUTES.AUTH, '/auth/callback', '/', '/blog', '/share']);
 
 // ============================================================================
 // Type Definitions
@@ -41,29 +36,16 @@ interface AuthCookies {
 // Helper Functions
 // ============================================================================
 
-/**
- * 检查 token 是否有效（非空且非无效值）
- */
 function isValidToken(token: string | undefined): token is string {
-  if (!token || INVALID_TOKEN_VALUES.has(token)) {
-    return false;
-  }
+  if (!token || INVALID_TOKEN_VALUES.has(token)) return false;
 
   return token.trim().length > 0;
 }
 
-/**
- * 清除所有认证相关的 cookies
- */
 function clearAuthCookies(response: NextResponse): void {
-  Object.values(AUTH_COOKIES).forEach((cookieName) => {
-    response.cookies.delete(cookieName);
-  });
+  Object.values(AUTH_COOKIES).forEach((name) => response.cookies.delete(name));
 }
 
-/**
- * 从请求中提取认证相关的 cookies
- */
 function extractAuthCookies(request: NextRequest): AuthCookies {
   return {
     token: request.cookies.get(AUTH_COOKIES.TOKEN)?.value,
@@ -72,108 +54,96 @@ function extractAuthCookies(request: NextRequest): AuthCookies {
   };
 }
 
-/**
- * 构建带有重定向参数的认证 URL
- */
-function buildAuthUrl(request: NextRequest): URL {
-  const { pathname, search } = request.nextUrl;
-  const redirectPath = pathname + search;
+function isTokenExpired({ timestamp, expiresIn }: AuthCookies): boolean {
+  if (!timestamp) return false;
 
-  const authUrl = new URL(ROUTES.AUTH, request.url);
+  const authTime = Number(timestamp);
+  if (Number.isNaN(authTime)) return true;
 
-  if (redirectPath && redirectPath !== ROUTES.AUTH) {
-    authUrl.searchParams.set('redirect_to', encodeURIComponent(redirectPath));
-  }
+  const expiryMs = expiresIn ? Number(expiresIn) * 1000 : DEFAULT_TOKEN_EXPIRY_MS;
 
-  return authUrl;
+  return Date.now() - authTime > expiryMs;
 }
 
 /**
- * 重定向到认证页面
+ * Check if a pathname is a public route (no auth required).
+ * Handles exact matches and prefix matches (e.g. /blog/123, /share/abc).
  */
-function redirectToAuth(
-  request: NextRequest,
-  options: { clearCookies?: boolean; reason?: string } = {},
-): NextResponse {
-  const { clearCookies = false, reason } = options;
-
-  const authUrl = buildAuthUrl(request);
-  const response = NextResponse.redirect(authUrl);
-
-  if (clearCookies) {
-    clearAuthCookies(response);
-  }
-
-  if (reason && process.env.NODE_ENV === 'development') {
-    console.log(`[Middleware] Redirecting to auth: ${reason}`);
-  }
+function isPublicRoute(pathname: string): boolean {
+  if (PUBLIC_ROUTES.has(pathname)) return true;
 
-  return response;
+  return (
+    pathname.startsWith('/blog/') || pathname.startsWith('/share/') || pathname.startsWith('/auth/')
+  );
 }
 
 /**
- * 检查 token 是否过期
+ * Redirect to the auth page.
+ * Only sets redirect_to for protected routes — never for public routes,
+ * which would otherwise cause an infinite redirect loop.
  */
-function isTokenExpired(authCookies: AuthCookies): boolean {
-  const { timestamp, expiresIn } = authCookies;
+function buildAuthRedirect(
+  request: NextRequest,
+  options: { clearCookies?: boolean } = {},
+): NextResponse {
+  const { pathname, search } = request.nextUrl;
+  const authUrl = new URL(ROUTES.AUTH, request.url);
 
-  if (!timestamp) {
-    return false;
+  if (!isPublicRoute(pathname)) {
+    // Let URLSearchParams handle encoding — avoid double-encoding (%252F)
+    authUrl.searchParams.set('redirect_to', pathname + search);
   }
 
-  const authTime = Number(timestamp);
+  const response = NextResponse.redirect(authUrl);
 
-  if (Number.isNaN(authTime)) {
-    return true;
+  if (options.clearCookies) {
+    clearAuthCookies(response);
   }
 
-  const now = Date.now();
-  const expiryMs = expiresIn ? Number(expiresIn) * 1000 : DEFAULT_TOKEN_EXPIRY_MS;
-
-  return now - authTime > expiryMs;
+  return response;
 }
 
 // ============================================================================
-// Main Middleware
+// Proxy (Next.js 16+)
 // ============================================================================
 
-/**
- * 认证中间件
- * 验证用户的 token，未登录或 token 过期时重定向到登录页
- */
 export function proxy(request: NextRequest): NextResponse {
+  const { pathname } = request.nextUrl;
+
+  // Always allow public routes through — no token check needed
+  if (isPublicRoute(pathname)) {
+    return NextResponse.next();
+  }
+
   const authCookies = extractAuthCookies(request);
 
-  // 验证 token 存在性和有效性
   if (!isValidToken(authCookies.token)) {
-    return redirectToAuth(request, {
-      reason: 'No valid token found',
-    });
+    return buildAuthRedirect(request);
   }
 
-  // 验证 token 是否过期
   if (isTokenExpired(authCookies)) {
-    return redirectToAuth(request, {
-      clearCookies: true,
-      reason: 'Token expired',
-    });
+    return buildAuthRedirect(request, { clearCookies: true });
   }
 
-  // Token 有效，放行请求
   return NextResponse.next();
 }
 
 // ============================================================================
-// Middleware Configuration
+// Proxy Configuration
 // ============================================================================
 
-/**
- * 配置需要认证保护的路径
- */
 export const config = {
   matcher: [
-    '/docs/:path*', // 文档页面
-    '/dashboard/:path*', // 控制台页面
-    '/chat-ai/:path*', // AI 聊天页面
+    /*
+     * Only run on protected routes. Public routes excluded:
+     * - Homepage: /
+     * - Auth: /auth, /auth/callback
+     * - Public content: /blog/*, /share/*
+     * - Next.js internals: /_next/*, /api/*
+     */
+    '/docs/:path*',
+    '/dashboard/:path*',
+    '/chat-ai/:path*',
+    '/rooms/:path*',
   ],
 };

apps/DocFlow/src/services/request/client.ts

@@ -99,20 +99,30 @@ class ClientRequest {
 
   /**
    * 统一处理认证失败
+   * 仅在受保护页面才跳转登录，公开页面静默清除凭证即可
    */
   private handleAuthFailure(): void {
     clearAuthData();
 
-    if (typeof window !== 'undefined') {
-      const currentPath = window.location.pathname + window.location.search;
-      const loginUrl = new URL(ROUTES.AUTH, window.location.origin);
+    if (typeof window === 'undefined') return;
 
-      if (currentPath && currentPath !== ROUTES.AUTH) {
-        loginUrl.searchParams.set('redirect_to', encodeURIComponent(currentPath));
-      }
+    const { pathname, search } = window.location;
 
-      window.location.href = loginUrl.toString();
-    }
+    // 公开路由不触发跳转，避免首页等公开页面被意外重定向
+    const isPublicPath =
+      pathname === '/' ||
+      pathname === ROUTES.AUTH ||
+      pathname.startsWith('/auth/') ||
+      pathname.startsWith('/blog/') ||
+      pathname.startsWith('/share/');
+
+    if (isPublicPath) return;
+
+    const loginUrl = new URL(ROUTES.AUTH, window.location.origin);
+    // 让 URLSearchParams 自行编码，避免双重 encodeURIComponent 产生 %252F
+    loginUrl.searchParams.set('redirect_to', pathname + search);
+
+    window.location.href = loginUrl.toString();
   }
 
   /**