ui phase 3

client/middleware.ts

@@ -3,7 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server';
 import { routing } from './src/i18n/routing';
 import { COOKIE_NAMES } from './src/lib/cookies';
 import { isTokenAlive } from './src/lib/auth/token';
-import { HEADER_NAMES, PUBLIC_PATHS, ROUTES } from './src/constants';
+import { HEADER_NAMES, PUBLIC_PATHS, RETURN_URL_PARAM, ROUTES } from './src/constants';
 
 const intlMiddleware = createMiddleware(routing);
 
@@ -26,7 +26,16 @@ export default function middleware(request: NextRequest) {
     const token = request.cookies.get(COOKIE_NAMES.ACCESS_TOKEN)?.value;
     if (!isTokenAlive(token)) {
       const locale = request.cookies.get('NEXT_LOCALE')?.value ?? routing.defaultLocale;
-      return NextResponse.redirect(new URL(`/${locale}${ROUTES.LOGIN}`, request.url));
+      const loginUrl = new URL(`/${locale}${ROUTES.LOGIN}`, request.url);
+      // Carry the attempted (locale-stripped) destination so a deep link — an SMS booking link, a
+      // shared nurse profile — survives the round trip through login instead of dumping the user
+      // on their role home. Validated same-origin + role-permitting on the way back out
+      // (resolvePostLoginDestination in services/auth/routing.ts); '/' is the default anyway.
+      const next = pathWithoutLocale + request.nextUrl.search;
+      if (next && next !== '/') {
+        loginUrl.searchParams.set(RETURN_URL_PARAM, next);
+      }
+      return NextResponse.redirect(loginUrl);
     }
   }