fix: polish authentication navigation and autofill

tests/auth-return.test.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { buildAuthPath, getSafeAuthReturnTo } from "../src/lib/auth-return.ts";
+
+test("keeps an internal route with its query and fragment", () => {
+  assert.equal(
+    getSafeAuthReturnTo("/events/summer-workshop?source=home#register"),
+    "/events/summer-workshop?source=home#register",
+  );
+});
+
+test("falls back for external and malformed return paths", () => {
+  for (const value of [
+    "https://attacker.example/",
+    "//attacker.example/",
+    "/\\attacker.example/",
+    `/${String.fromCharCode(0)}forbidden`,
+    "javascript:alert(1)",
+  ]) {
+    assert.equal(getSafeAuthReturnTo(value), "/profile");
+  }
+});
+
+test("does not return to authentication or logout routes", () => {
+  for (const value of ["/auth", "/auth/google/callback", "/logout", "/reset-password"]) {
+    assert.equal(getSafeAuthReturnTo(value), "/profile");
+  }
+});
+
+test("builds a login link that safely encodes the requested route", () => {
+  assert.equal(
+    buildAuthPath("/events/summer-workshop?source=home"),
+    "/auth?next=%2Fevents%2Fsummer-workshop%3Fsource%3Dhome",
+  );
+  assert.equal(buildAuthPath("//attacker.example/"), "/auth?next=%2Fprofile");
+});