Cancel on the vault unlock page returns to a redirect-only page #4288

Initial Checklist

• I understand this is a bug report and questions should be posted in the Community Discussions
• I searched issues and couldn’t find anything (or linked relevant results below)

Bug Description

Cancel on the vault unlock page sends the user back to a redirect-only page. getCancelUrl() in packages/web-runtime/src/router/setupVaultUnlockGuard.ts accepts any named route outside the vault, including resolver and callback routes (resolvePublicLink, resolvePublicOcmLink, oidcCallback) that only redirect. #4155 only excluded resolvePrivateLink.

Reproduction Steps

1. Create a folder with a vault inside and a password-protected link on the folder
2. Open /files/link/public/<token>/<vault> in a fresh browser, enter the link password, click Cancel on the unlock page
3. Log out, open a URL into a vault in your personal space, log in, click Cancel on the unlock page

Expected Outcome

Cancel leaves the locked vault, to the folder that holds it or the page the user came from.

Actual Outcome

From the public link, Cancel resolves the link again and the unlock page comes back. After a login, Cancel opens the OIDC callback page, which shows a spinner forever.