- Add sanitizeRedirect/safeRedirectTarget helper; reject anything that isn't
a safe local path (must start with a single /, no scheme, no whitespace,
not /login itself). Apply in RequireAuth when encoding the current pathname
and in AuthLogin when consuming ?redirect=.
- Make configureApi's getToken read localStorage directly via readCurrentToken
so the first request after login cannot race the AuthContext re-render that
previously owned the token via a React closure.
- Redirect legacy /auth/* (including the pre-flatten /auth/auth1/login) with
HTTP 301 to /login in the webui handler so stale bookmarks can't seed the
SPA router with a malformed URL.
- Regression test TestHandler_LegacyAuthPathRedirectsToLogin covering four
legacy path shapes.
GraceSolutions
329825ce86