plainleaf/client/lib/auth_redirect.ts

/**
 * Resolve an authentication target for a boot fetch. Safari may hide the
 * Location header on manual redirects, so protected 401 responses need a
 * same-origin fallback instead of leaving the app shell blank.
 */
export function authenticationRedirectTarget(
  response: Pick<Response, "status" | "type">,
  locationHeader: string | null,
  baseURI: string,
): string | null {
  if (locationHeader) return new URL(locationHeader, baseURI).toString();
  if (response.status === 401 || response.type === "opaqueredirect") {
    return new URL(".auth", baseURI).toString();
  }
  return null;
}