feat : big update

lib/auth/return-path.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest";
+import { safeAuthReturnPath } from "./return-path";
+
+describe("public auth return path", () => {
+  it("keeps site-local destinations", () => {
+    expect(safeAuthReturnPath("/commission/tickets?from=login")).toBe("/commission/tickets?from=login");
+  });
+
+  it("rejects external destinations and auth loops", () => {
+    for (const value of ["https://example.com", "//example.com", "/\\example.com", "/login", "/lo%67in", "/register", 4])
+      expect(safeAuthReturnPath(value)).toBe("/");
+  });
+});