fix: restrict auth callback redirects

apps/web/src/app/auth/callback/route.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+
+import { safeNextPath } from './route';
+
+describe('safeNextPath', () => {
+  it('keeps internal callback paths', () => {
+    expect(safeNextPath('/dashboard')).toBe('/dashboard');
+    expect(safeNextPath('/session/abc?tab=chat')).toBe('/session/abc?tab=chat');
+  });
+
+  it('falls back for external callback targets', () => {
+    expect(safeNextPath('https://evil.example/phish')).toBe('/dashboard');
+    expect(safeNextPath('//evil.example/phish')).toBe('/dashboard');
+  });
+
+  it('falls back for missing or relative callback targets', () => {
+    expect(safeNextPath(null)).toBe('/dashboard');
+    expect(safeNextPath('dashboard')).toBe('/dashboard');
+  });
+});

apps/web/src/app/auth/callback/route.ts

@@ -2,12 +2,20 @@
 import { createServerClient, type CookieOptions } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
 
+export function safeNextPath(next: string | null): string {
+  if (!next || !next.startsWith('/') || next.startsWith('//')) {
+    return '/dashboard';
+  }
+
+  return next;
+}
+
 export async function GET(request: NextRequest) {
   const { searchParams } = new URL(request.url);
   const code = searchParams.get('code');
   const tokenHash = searchParams.get('token_hash');
   const type = searchParams.get('type');
-  const next = searchParams.get('next') ?? '/dashboard';
+  const next = safeNextPath(searchParams.get('next'));
   const origin = process.env.NEXT_PUBLIC_APP_URL ?? 'https://pairux.com';
   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL ?? '';
   const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? '';