Function isValidCallbackPath

apps/web/src/lib/getSignInCallbackUrl.ts:17–41

(path: string)

}

export function isValidCallbackPath(path: string): boolean {
  if (
    path.startsWith('/users/accept-invite') ||
    path.startsWith('/get-started') ||
    path.startsWith('/welcome/landing') ||
    path.startsWith('/organizations/') ||
    path === '/claw' ||
    path.startsWith('/claw/') ||
    path.startsWith('/cloud') ||
    path === '/subscriptions/kilo-pass' ||
    path.startsWith('/subscriptions/kilo-pass/') ||
    path.startsWith('/integrations/') ||
    // Admin-managed URL bonus campaigns. Stricter shape enforcement
    // (slug format, prefix-match guard) happens in
    // `isCreditCampaignCallback`; this check only decides whether the
    // sign-in redirect is allowed to preserve the path.
    path.startsWith('/c/')
  ) {
    return true;
  }
  if (isValidIntegrationOAuthConnectCallbackPath(path)) {
    return true;
  }
  return CALLBACK_PATH_REGEX.test(path);
}

function isValidIntegrationOAuthConnectCallbackPath(path: string): boolean {
  if (!path.startsWith('/api/integrations/') || path.startsWith('//')) {