context.customerAccount.authorize doesn't not redirect to the route that initiated the login

[jmdalmasso]

What is the location of your example repository?

https://github.com/jmdalmasso/h2-login-redirect

Which package or tool is having this issue?

Hydrogen

What version of that package or tool are you using?

2024.7.9

What version of Remix are you using?

^2.10.1

Steps to Reproduce

In the prodived repo, navigate to the /start route > this will redirect you to the new Customer Account login > login and you are redirected to the account/authorize route > then you are redirected to /account even though this is not the route that initiated the login.

Expected Behavior

According to the documentation, the route that initiates the login is the route that should be redirected to when the login is finished:

"At the end of this authorization step, the application redirects back to the page that initiated the login."

This would be expected behavior anyways, or at the minimum be easy to configure in code.

Actual Behavior

The successful login always redirects to /account (which seems to be a hardcoded default). This is prevents a seemless login experience in scenarios where we just want to log the customer in but not redirect them to their account page.

[blittle]

Hi @jmdalmasso sorry for the delay. What's the goal of the /start route? Is it meant to replace /account/login? The abstraction and default implementation:

1. There's a login route, the login route optionally takes a return_to search param -> /account/login?return_to=/somepath
2. All authenticated routes should call await context.customerAccount.handleAuthStatus();. This checks if the user is logged in, if they are, the route loads like normal. If they are not, they are forwarded to /account/login?return_to=%whateverCurrentRoute%.
3. If you want to change the default account route paths, you should provide a customAuthStatusHandler inside context.js:

  const hydrogenContext = createHydrogenContext({
    env,
    request,
    cache,
    waitUntil,
    session,
    i18n: {language: 'EN', country: 'US'},
    cart: {
      queryFragment: CART_QUERY_FRAGMENT,
    },
    customerAccount: {
      customAuthStatusHandler: () => {
        const DEFAULT_LOGIN_URL = '/account/login';

        if (!request.url) return DEFAULT_LOGIN_URL;
      
        const {pathname} = new URL(request.url);
      
        const redirectTo =
          DEFAULT_LOGIN_URL +
          `?${new URLSearchParams({return_to: pathname}).toString()}`;
      
        return redirect(redirectTo);
      }
    },
  });

The assumption here is that you should always link to authenticated resources, if you aren't authenticated the auth status handler will run, setting up return_to for you. At the moment there's no way to override the default /account route if you link directly to the login page. Again, I don't think it's best to link directly to the login page, instead link to your account resource directly. But this has come up enough that I think we should provide a simple param to override the default redirect path.