Fix SSO url parse

Author: Yelo420

src/components/Login.tsx

@@ -44,45 +44,38 @@ export function Login() {
 
   // Parse SSO redirect style: {server}/access_token=...&refresh_token=...
   useEffect(() => {
-    // Detect tokens embedded after origin (no question mark) e.g. https://srv/access_token=XXX&refresh_token=YYY
-    // Or possibly inside hash.
     try {
       const loc = window.location;
-      const path = loc.pathname.startsWith("/")
-        ? loc.pathname.slice(1)
-        : loc.pathname;
+      const search = loc.search.startsWith("?") ? loc.search.substring(1) : loc.search;
+      const path = loc.pathname.startsWith("/") ? loc.pathname.slice(1) : loc.pathname;
       const hash = loc.hash.startsWith("#") ? loc.hash.slice(1) : loc.hash;
-      const candidate = path.includes("access_token=") ? path : hash;
-      if (!candidate) return;
-      if (!/access_token=/.test(candidate)) return;
-      // Interpret as key=value pairs separated by & possibly with leading segment (e.g., access_token=...&refresh_token=...)
-      const pairs = candidate.split("&").filter(Boolean);
-      const data: Record<string, string> = {};
-      for (const p of pairs) {
-        const eq = p.indexOf("=");
-        if (eq === -1) continue;
-        const k = decodeURIComponent(p.slice(0, eq));
-        const v = decodeURIComponent(p.slice(eq + 1));
-        data[k] = v;
-      }
-      if (!data.access_token) return;
-      // Determine server base: remove the trailing candidate part from URL if it's at pathname
-      const base = window.location.origin;
+
+      // Priority order: query string (?access_token=...), then path style, then hash fragment.
+      let candidate = "";
+      if (/access_token=/.test(search)) candidate = search;
+      else if (/access_token=/.test(path)) candidate = path;
+      else if (/access_token=/.test(hash)) candidate = hash;
+      if (!candidate) return; // no tokens present
+
+      const params = new URLSearchParams(candidate.replace(/^[^?]*\?/, ""));
+      const access = params.get("access_token") || "";
+      const refresh = params.get("refresh_token") || undefined;
+      if (!access) return;
+
+      const base = window.location.origin; // assume same origin the user entered for SSO
       (async () => {
         try {
-          await loginWithTokens(base, {
-            access_token: data.access_token,
-            refresh_token: data.refresh_token,
-          });
-          // Clean URL (remove tokens) then navigate
-          window.history.replaceState({}, document.title, base + "/login");
+          await loginWithTokens(base, { access_token: access, refresh_token: refresh });
+          // Scrub sensitive tokens from URL: go to /login (or /library directly after navigation) without query/hash.
+          const cleanUrl = base + "/login";
+            window.history.replaceState({}, document.title, cleanUrl);
           navigate("/library", { replace: true });
         } catch {
-          // ignore - error shown via context
+          // ignore - context will show error
         }
       })();
     } catch {
-      // ignore parsing errors
+      // swallow parsing errors silently
     }
   }, [loginWithTokens, navigate]);