use only the payload

Gemfile.lock

@@ -14,6 +14,7 @@ PATH
       prop_initializer (>= 0.2.0)
       turbo-rails (>= 2.0.0)
       turbo_power (>= 0.6.0)
+      universalid
       view_component (>= 3.7.0)
       zeitwerk (>= 2.6.12)
 
@@ -161,6 +162,7 @@ GEM
     bindex (0.8.1)
     bootsnap (1.18.4)
       msgpack (~> 1.2)
+    brotli (0.6.0)
     builder (3.3.0)
     bump (0.10.0)
     bundler-integrity (1.0.9)
@@ -179,6 +181,9 @@ GEM
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
     concurrent-ruby (1.3.5)
+    config (5.5.2)
+      deep_merge (~> 1.2, >= 1.2.1)
+      ostruct
     connection_pool (2.5.0)
     countries (7.1.0)
       unaccent (~> 0.3)
@@ -201,6 +206,7 @@ GEM
     debug (1.10.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
+    deep_merge (1.2.2)
     derailed_benchmarks (2.1.2)
       benchmark-ips (~> 2)
       dead_end
@@ -418,6 +424,7 @@ GEM
     nokogiri (1.18.1-x86_64-linux-gnu)
       racc (~> 1.4)
     orm_adapter (0.5.0)
+    ostruct (0.6.1)
     pagy (9.3.3)
     parallel (1.26.3)
     parser (3.3.6.0)
@@ -648,6 +655,12 @@ GEM
       concurrent-ruby (~> 1.0)
     unaccent (0.4.0)
     unicode-display_width (2.6.0)
+    universalid (0.1.7)
+      activesupport (>= 6.1)
+      brotli (>= 0.4)
+      config (>= 5.0)
+      msgpack (>= 1.7)
+      zeitwerk (>= 2.6)
     uri (1.0.2)
     useragent (0.16.11)
     view_component (3.21.0)

app/components/avo/base_component.rb

@@ -5,6 +5,8 @@ class Avo::BaseComponent < ViewComponent::Base
   include Turbo::FramesHelper
   include Avo::Concerns::FindAssociationField
 
+  delegate :e, to: :helpers
+
   def has_with_trial(ability)
     Avo.license.has_with_trial(ability)
   end

app/controllers/avo/base_application_controller.rb

@@ -14,6 +14,7 @@ class BaseApplicationController < ::ActionController::Base
     include Avo::Concerns::FindAssociationField
 
     protect_from_forgery with: :exception
+    before_action :decode_params
     around_action :set_avo_locale
     around_action :set_force_locale, if: -> { params[:force_locale].present? }
     before_action :init_app
@@ -29,7 +30,7 @@ class BaseApplicationController < ::ActionController::Base
     rescue_from Avo::NotAuthorizedError, with: :render_unauthorized
     rescue_from ActiveRecord::RecordInvalid, with: :exception_logger
 
-    helper_method :_current_user, :resources_path, :resource_path, :new_resource_path, :edit_resource_path, :resource_attach_path, :resource_detach_path, :related_resources_path, :turbo_frame_request?, :resource_view_path, :preview_resource_path
+    helper_method :_current_user, :resources_path, :resource_path, :new_resource_path, :edit_resource_path, :resource_attach_path, :resource_detach_path, :related_resources_path, :turbo_frame_request?, :resource_view_path, :preview_resource_path, :e
     add_flash_types :info, :warning, :success, :error
 
     def exception_logger(exception)
@@ -330,5 +331,12 @@ def authenticate_developer_or_admin!
     def raise_404
       raise ActionController::RoutingError.new "No route matches"
     end
+
+    def decode_params
+      if params[:return_to].present?
+        params[:raw_return_to] = params[:return_to]
+        params[:return_to] = d(params[:return_to])
+      end
+    end
   end
 end

app/helpers/avo/application_helper.rb

@@ -159,6 +159,18 @@ def container_classes
       @container_classes = @container_full_width ? "" : "2xl:container 2xl:mx-auto"
     end
 
+    # encode params
+    def e(value)
+      URI::UID.build(value).payload
+    end
+
+    # decode params
+    def d(value)
+      URI::UID.from_payload(value).decode
+    rescue
+      value
+    end
+
     private
 
     # Taken from the original library

avo.gemspec

@@ -48,4 +48,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "docile"
   spec.add_dependency "inline_svg"
   spec.add_dependency "prop_initializer", ">= 0.2.0"
+  spec.add_dependency "universalid"
 end