From c5a57aab3684b6839a7354df7639d22d86395a60 Mon Sep 17 00:00:00 2001
From: Cannon Lock <clock@wisc.edu>
Date: Thu, 14 Dec 2023 16:18:51 -0600
Subject: [PATCH] Add start to auth ui

---
 packages/security/src/index.ts                | 6 +++++-
 src/pages/dev/security/endpoint/index.page.ts | 9 +++++++++
 src/pages/dev/security/index.page.route.ts    | 4 ++--
 3 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 src/pages/dev/security/endpoint/index.page.ts

diff --git a/packages/security/src/index.ts b/packages/security/src/index.ts
index ad9978cc..dd23226a 100644
--- a/packages/security/src/index.ts
+++ b/packages/security/src/index.ts
@@ -10,7 +10,11 @@ export const secureFetch = async (url, options) => {
   const response = await fetch(url, options);
 
   if (response.status === 401 || response.status === 403) {
-    window.open(`${import.meta.env.VITE_MACROSTRAT_INGEST_API}/security/login`, '_blank').focus();
+
+    const url = new URL(`${import.meta.env.VITE_MACROSTRAT_INGEST_API}/security/login`);
+    url.searchParams.append("return_url", `${window.location.origin}/dev/security/endpoint`);
+
+    window.open(url, '_blank').focus();
     throw {name: "UnauthorizedError", message: "User is not logged in"}
   }
 
diff --git a/src/pages/dev/security/endpoint/index.page.ts b/src/pages/dev/security/endpoint/index.page.ts
new file mode 100644
index 00000000..d56f3f43
--- /dev/null
+++ b/src/pages/dev/security/endpoint/index.page.ts
@@ -0,0 +1,9 @@
+import {default as h} from "@macrostrat/hyper";
+
+export function Page() {
+
+  return h("div", [
+    h("span", "You are logged in, you can now close this tab.")
+  ]);
+}
+
diff --git a/src/pages/dev/security/index.page.route.ts b/src/pages/dev/security/index.page.route.ts
index 136e3185..842275a7 100644
--- a/src/pages/dev/security/index.page.route.ts
+++ b/src/pages/dev/security/index.page.route.ts
@@ -13,8 +13,8 @@ export const guard = (pageContext) => {
     throw redirect('/login')
     */
   }
-  if (!user.groups.includes("admin")) {
+  if (!user.groups.includes(1)) {
     // Render the error page and show message to the user
-    throw render(403, 'Only admins are allowed to access this page.')
+    return render(403, 'Only admins are allowed to access this page.')
   }
 }
\ No newline at end of file