From bde51a8b69abfde10e7bd7a4946f6dedc84a351a Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Wed, 8 Apr 2026 10:04:08 +0530
Subject: [PATCH] fix: prevent stale workspace URL from post-login redirect

---
 app/Config/Auth.php | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/Config/Auth.php b/app/Config/Auth.php
index a3a57e2..2d49eae 100644
--- a/app/Config/Auth.php
+++ b/app/Config/Auth.php
@@ -441,7 +441,20 @@ class Auth extends ShieldAuth
     public function loginRedirect(): string
     {
         $session = session();
-        $url     = $session->getTempdata('beforeLoginUrl') ?? setting('Auth.redirects')['login'];
+        $beforeLoginUrl = (string) ($session->getTempdata('beforeLoginUrl') ?? '');
+
+        // Some AJAX workspace URLs can be stored as beforeLoginUrl in production
+        // and then hijack post-login landing. Skip those and use configured default.
+        if ($beforeLoginUrl !== '') {
+            $path = (string) parse_url($beforeLoginUrl, PHP_URL_PATH);
+            $path = '/' . ltrim($path, '/');
+            if ($path === '/doctor_work/document_workspace') {
+                $beforeLoginUrl = '';
+                $session->removeTempdata('beforeLoginUrl');
+            }
+        }
+
+        $url = $beforeLoginUrl !== '' ? $beforeLoginUrl : (string) setting('Auth.redirects')['login'];
 
         return $this->getUrl($url);
     }