fix(auth): sanitize next redirects

[AyobamiH]

Closes #161.

What changed

• Adds a shared safeNext helper for authentication redirects.
• Accepts only root-relative same-origin paths.
• Rejects absolute URLs, protocol-relative URLs, backslashes and ASCII control characters.
• Uses the same sanitizer in both the email sign-in flow and OAuth callback.
• Preserves query strings and fragments on valid internal paths.
• Adds focused unit coverage for safe and unsafe redirect inputs.

Both redirect consumers now apply the same policy rather than relying on different client and server behaviour.

Verification

Final commit:

4ae07fb3d08a5ea42fc2164c00c74f58a2ed7467

On the final source:

• npm run build passed
• npm run lint passed
• npx tsc --noEmit passed
• place-data validation passed

Unit validation used the same source plus a temporary CI-only test job:

• 12 test files passed
• 108 tests passed
• 16 safeNext cases passed

Validation PR:
AyobamiH#4

[vercel]

@AyobamiH is attempting to deploy a commit to the studentsuite Team on Vercel.

A member of the Team first needs to authorize it.

[shauryagangrade]

Review: sanitize next redirects (#161)

LGTM. Verified this covers both existing next consumers (grep get("next") over src returns exactly login-form.tsx and auth/callback/route.ts) — no stragglers.

The sanitizer handles the full known-bypass catalog:

• absolute URLs and protocol-relative // / /// ✓
• backslashes (/\evil.example) — browsers normalize \ → / in special schemes ✓
• control chars incl. \t, \n, \0 — important because the WHATWG URL parser strips tabs/newlines, so /\n//evil.example would otherwise smuggle through a naive startsWith check ✓
• relative junk (map, ?next=/map, #map) falls back to / ✓
• query strings and fragments survive on legitimate internal paths ✓

Tests pin all the adversarial cases, including the ones people usually forget (\u0000, tab/newline prefixes). CI green.

One optional future nicety, not blocking: if you ever want allowlist-level strictness, validating against the app's route table would catch typos like /maap — but same-origin-only is the correct security boundary here, and stricter than that is product territory.

Nice, tight security fix.