feat: SPA navigation for post-auth redirects by arbrandes · Pull Request #1647 · openedx/frontend-app-authn

arbrandes · 2026-03-13T19:40:47Z

Description

When a user navigates to a protected SPA route while logged out, authenticatedLoader redirects to /authn/login?next=/some-path. Previously, this relative next param was forwarded to the LMS backend, which resolved it against itself and returned an absolute LMS URL, causing a full page navigation away from the SPA shell. Now the relative path is handled locally after login/registration succeeds, using <Navigate> for seamless SPA navigation.

This also revealed that the authn app's navigation was still using absolute path constants like '/login', which don't resolve correctly under the /authn route prefix. All navigation now goes through getUrlByRouteRole() to resolve URLs from the route config, and components like UnAuthOnlyRoute, ChangePasswordPrompt, and ProgressiveProfiling use SPA navigation instead of window.location.href when the target is internal.

Finally, when the LMS backend returns its own dashboard URL as redirect_url after login or registration, it is normalized to the role-based dashboard URL via a shared normalizeRedirectUrl() utility, so RedirectLogistration can navigate without a full page reload.

Depends on openedx/frontend-base#183, and indirectly on openedx/frontend-app-learner-dashboard#806.

Note to reviewer

Start the review with src/constants.ts and src/routes.tsx. It makes the rest easier to understand.

Testing

Set up a complete frontend-template-site with all the latest changes in frontend-base, authn, and learner-dashboard. After that, make sure login and registration still work, including by manually navigating to /learner-dashboard without having logged in first (if you installed openedx/frontend-app-learner-dashboard#806).

LLM usage notice

Built with assistance from Claude models (mostly Opus 4.6).

codecov · 2026-03-13T19:43:43Z

Codecov Report

❌ Patch coverage is 83.33333% with 13 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (frontend-base@c0cf462). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...essive-profiling/ProgressiveProfilingPageModal.jsx	20.00%	4 Missing ⚠️
src/login/LoginPage.jsx	75.00%	2 Missing ⚠️
src/register/RegistrationPage.jsx	75.00%	2 Missing ⚠️
src/common-components/EnterpriseSSO.jsx	50.00%	1 Missing ⚠️
src/common-components/RedirectLogistration.jsx	50.00%	1 Missing ⚠️
src/login/ChangePasswordPrompt.jsx	83.33%	1 Missing ⚠️
src/logistration/Logistration.jsx	87.50%	1 Missing ⚠️
src/progressive-profiling/ProgressiveProfiling.jsx	80.00%	1 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##             frontend-base    #1647   +/-   ##
================================================
  Coverage                 ?   92.12%           
================================================
  Files                    ?       92           
  Lines                    ?     2045           
  Branches                 ?      588           
================================================
  Hits                     ?     1884           
  Misses                   ?      158           
  Partials                 ?        3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jesusbalderramawgu

thank you, this is a great catch

When a user navigates to a protected SPA route while logged out, the authenticatedLoader redirects to /authn/login?next=%2Fsome-path. Previously, this relative next param was sent to the LMS backend, which resolved it against itself and returned an absolute LMS URL — causing a full page navigation away from the SPA shell. Now, when next starts with /, it is stripped from the API payload and handled locally: after login/registration succeeds, fetchAuthenticatedUser refreshes the auth cache so authenticatedLoader allows the target route, RedirectLogistration uses <Navigate> for SPA navigation, and hydrateAuthenticatedUser runs in the background to populate the full user profile (avatar, etc.) in the header. Also applies the same relative-path SPA navigation pattern to ProgressiveProfilingPageModal and replaces the hardcoded LMS dashboard fallback in the registration API with getUrlByRouteRole for consistency. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Routes are nested by default, but navigation constants used absolute paths like '/login', causing navigate() and <Navigate> to go to /login instead of /authn/login. Replace path constants in navigation calls with getUrlByRouteRole() where possible, which resolves the URL for a given route role from the route config. Path constants are still generally useful, but are now all relative (and camelCase). Centralize route roles, path segments, and the dashboard role in src/constants.ts. Last but not least, prefer SPA navigation (<Navigate>, useNavigate) over window.location.href where the target URL may be internal. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When the backend returns the LMS dashboard URL as redirect_url after login or registration, replace it with getUrlByRouteRole(dashboardRole) so that RedirectLogistration can use <Navigate> for SPA navigation instead of a full page reload. Also hydrate the authenticated user before SPA navigation so the shell header displays the user's name. This applies the same fetchAuthenticatedUser/hydrateAuthenticatedUser pattern already used for the localNextPath flow to any redirect URL that starts with '/'. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

holaontiveros · 2026-03-19T18:19:08Z

        setRedirectToResetPasswordPage(true);
      } else {
-        window.location.href = redirectUrl || getSiteConfig().lmsBaseUrl.concat(DEFAULT_REDIRECT_URL);
+        const url = redirectUrl || getUrlByRouteRole(dashboardRole);


Random though we should have in some doc that if someone is not using the dashboard frontend-app they'll need to make sure that the external route for it it's configured

A good point, but the idea is for the dashboard role to actually be optional. If there's no dashboard role we should just use whatever the LMS gives, and failing that to go to "/", and that's up to the site operator to decide what to do with.

would that redirectUrl be the one that the LMS gives? if that's the case then great

Yes, the redirectUrl is what the LMS returns. (Except when we normalize it to be relative for SPA navigation - if the dashboard role exists.)

I just realized I'm not actually treating the dashboard role as optional in this PR. Note to self: fix it.

Fixed in 12bc42c.

If the dashboard route role isn't registered, getUrlByRouteRole() returns undefined, breaking navigation. Fall back to '/' in all four call sites so the app degrades gracefully. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openedx-semantic-release-bot · 2026-04-02T18:03:38Z

🎉 This PR is included in version 1.0.0-alpha.7 🎉

The release is available on:

Your semantic-release bot 📦🚀

arbrandes mentioned this pull request Mar 13, 2026

Login redirect not working openedx/frontend-base#142

Closed

arbrandes requested review from brian-smith-tcril, holaontiveros and jesusbalderramawgu March 13, 2026 19:42

jesusbalderramawgu approved these changes Mar 13, 2026

View reviewed changes

arbrandes force-pushed the login-redirection branch 3 times, most recently from b04929e to 4ff413c Compare March 16, 2026 21:10

arbrandes mentioned this pull request Mar 16, 2026

Navigation constants use absolute paths, breaking routing under /authn prefix #1648

Closed

arbrandes changed the title ~~feat: handle relative next param locally after login/registration~~ feat: SPA navigation for post-auth redirects Mar 16, 2026

arbrandes and others added 4 commits March 16, 2026 18:54

refactor: simplify onSuccess redirect logic in login and registration

b611c4d

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

arbrandes force-pushed the login-redirection branch from ba527eb to b611c4d Compare March 16, 2026 22:02

holaontiveros reviewed Mar 19, 2026

View reviewed changes

holaontiveros approved these changes Mar 19, 2026

View reviewed changes

arbrandes merged commit 575892f into openedx:frontend-base Mar 19, 2026
4 checks passed

arbrandes deleted the login-redirection branch March 19, 2026 22:47

openedx-semantic-release-bot added the released on @latest label Apr 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: SPA navigation for post-auth redirects#1647

feat: SPA navigation for post-auth redirects#1647
arbrandes merged 5 commits into
openedx:frontend-basefrom
arbrandes:login-redirection

arbrandes commented Mar 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Mar 13, 2026 •

edited

Loading

Uh oh!

jesusbalderramawgu left a comment

Uh oh!

Uh oh!

Uh oh!

holaontiveros Mar 19, 2026

Uh oh!

arbrandes Mar 19, 2026

Uh oh!

holaontiveros Mar 19, 2026

Uh oh!

arbrandes Mar 19, 2026

Uh oh!

arbrandes Mar 19, 2026

Uh oh!

arbrandes Mar 19, 2026

Uh oh!

Uh oh!

openedx-semantic-release-bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

arbrandes commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Note to reviewer

Testing

LLM usage notice

Uh oh!

codecov Bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jesusbalderramawgu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

holaontiveros Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

arbrandes Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

holaontiveros Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

arbrandes Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

arbrandes Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

arbrandes Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openedx-semantic-release-bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

arbrandes commented Mar 13, 2026 •

edited

Loading

codecov Bot commented Mar 13, 2026 •

edited

Loading