ui phase 3

client/src/services/auth/routing.test.ts

@@ -1,5 +1,5 @@
 import { ROUTES } from '@/constants';
-import { isAdminRole, resolveRoleDestination, toAppRoles } from './routing';
+import { isAdminRole, resolvePostLoginDestination, resolveRoleDestination, toAppRoles } from './routing';
 import type { RoleCode } from './types';
 
 describe('toAppRoles', () => {
@@ -56,3 +56,34 @@ describe('resolveRoleDestination (role-router branches)', () => {
     expect(resolveRoleDestination({ roles: ['customer', 'nurse'] })).toBe(ROUTES.HOME);
   });
 });
+
+describe('resolvePostLoginDestination (returnUrl)', () => {
+  it('honors a safe same-origin next path the session is allowed to reach', () => {
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, '/bookings/42')).toBe('/bookings/42');
+  });
+
+  it('honors a nurse-owned next path for a nurse session', () => {
+    expect(resolvePostLoginDestination({ roles: ['nurse'] }, undefined, '/nurse/requests')).toBe('/nurse/requests');
+  });
+
+  it('falls back to the role destination for a protocol-relative next (open-redirect guard)', () => {
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, '//evil.com')).toBe(ROUTES.HOME);
+  });
+
+  it('falls back to the role destination for an absolute-URL next (open-redirect guard)', () => {
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, 'https://evil.com')).toBe(ROUTES.HOME);
+  });
+
+  it('falls back when next belongs to a role the session does not hold', () => {
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, '/nurse/requests')).toBe(ROUTES.HOME);
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, '/admin/audit')).toBe(ROUTES.HOME);
+  });
+
+  it('falls back to select-role for a role-less user regardless of next', () => {
+    expect(resolvePostLoginDestination({ roles: [] }, undefined, '/bookings')).toBe(ROUTES.SELECT_ROLE);
+  });
+
+  it('falls back to the role destination when next is absent', () => {
+    expect(resolvePostLoginDestination({ roles: ['customer'] }, undefined, null)).toBe(ROUTES.HOME);
+  });
+});

client/src/services/auth/routing.ts

@@ -45,3 +45,38 @@ export function resolveRoleDestination(me: Pick<Me, 'roles'>, intendedRole?: App
 
   return target === APP_ROLES.NURSE ? ROUTES.NURSE : ROUTES.HOME;
 }
+
+/** True for a same-origin relative path only — rejects a protocol-relative (`//host`) or absolute-URL `next`. */
+function isSafeRelativePath(path: string): boolean {
+  return path.startsWith('/') && !path.startsWith('//') && !path.startsWith('/\\');
+}
+
+/** The app (nurse/admin/customer) whose route tree owns `path`; customer paths carry no prefix. */
+function appRoleForPath(path: string): AppRole | null {
+  const pathname = path.split('?')[0].split('#')[0];
+  if (pathname === ROUTES.NURSE || pathname.startsWith(`${ROUTES.NURSE}/`)) return APP_ROLES.NURSE;
+  if (pathname === ROUTES.ADMIN || pathname.startsWith(`${ROUTES.ADMIN}/`)) return APP_ROLES.ADMIN;
+  // The partner portal isn't an AppRole (it self-gates via useMyPartnerCenter) — never a `next` target.
+  if (pathname === ROUTES.PARTNER || pathname.startsWith(`${ROUTES.PARTNER}/`)) return null;
+  return APP_ROLES.CUSTOMER;
+}
+
+/**
+ * The `?next=` deep-link carried through login (middleware.ts appends it on the redirect-to-login).
+ * Returns `next` only when it is a validated same-origin relative path **and** the resolved session
+ * actually holds the role that owns it (a customer's `next=/nurse/...` falls through) — otherwise
+ * defers to `resolveRoleDestination`, which stays the single "which app" source of truth. Never
+ * returns an absolute URL or a protocol-relative path — this is the one guard against `next`
+ * becoming an open redirect.
+ */
+export function resolvePostLoginDestination(
+  me: Pick<Me, 'roles'>,
+  intendedRole: AppRole | undefined,
+  next: string | null | undefined,
+): string {
+  if (next && isSafeRelativePath(next)) {
+    const owner = appRoleForPath(next);
+    if (owner && toAppRoles(me.roles).includes(owner)) return next;
+  }
+  return resolveRoleDestination(me, intendedRole);
+}