A bunch of fixes

internal/web/auth.go

@@ -9,21 +9,29 @@ import (
 	"uPortal/internal/auth"
 )
 
-// HandleSignin renders the sign-in page on GET and authenticates on POST.
+// For relative paths, redirect directly; for external URLs, route
+// through the warning page unless the domain is trusted.
+func (s *WebService) handleRedirect(w http.ResponseWriter, r *http.Request) {
+	redirectTo := "/"
+	if r.FormValue("redirect") != "" {
+		redirectTo = r.FormValue("redirect")
+	} else if r.URL.Query().Get("redirect") != "" {
+		redirectTo = r.URL.Query().Get("redirect")
+	}
+
+	if strings.HasPrefix(redirectTo, "/") && !strings.Contains(redirectTo, "://") {
+		http.Redirect(w, r, redirectTo, http.StatusSeeOther)
+	} else if s.isTrustedTarget(redirectTo) {
+		http.Redirect(w, r, redirectTo, http.StatusSeeOther)
+	} else {
+		http.Redirect(w, r, "/redirect?to="+url.QueryEscape(redirectTo), http.StatusSeeOther)
+	}
+}
+
 func (s *WebService) HandleSignin(w http.ResponseWriter, r *http.Request) {
 	// If already authenticated, redirect
 	if _, err := s.currentUser(r); err == nil {
-		redirectTo := "/"
-		if r.URL.Query().Get("redirect") != "" {
-			redirectTo = r.URL.Query().Get("redirect")
-		}
-		// For relative paths, redirect directly; for external URLs, route
-		// through the warning page.
-		if strings.HasPrefix(redirectTo, "/") && !strings.Contains(redirectTo, "://") {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else {
-			http.Redirect(w, r, "/redirect?to="+url.QueryEscape(redirectTo), http.StatusSeeOther)
-		}
+		s.handleRedirect(w, r)
 		return
 	}
 
@@ -77,41 +85,14 @@ func (s *WebService) HandleSignin(w http.ResponseWriter, r *http.Request) {
 			MaxAge:   maxAge,
 		}
 		http.SetCookie(w, cookie)
-
-		redirectTo := "/"
-		if r.FormValue("redirect") != "" {
-			redirectTo = r.FormValue("redirect")
-		} else if r.URL.Query().Get("redirect") != "" {
-			redirectTo = r.URL.Query().Get("redirect")
-		}
-		// For relative paths, redirect directly; for external URLs, route
-		// through the warning page unless the domain is trusted.
-		if strings.HasPrefix(redirectTo, "/") && !strings.Contains(redirectTo, "://") {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else if s.isTrustedTarget(redirectTo) {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else {
-			http.Redirect(w, r, "/redirect?to="+url.QueryEscape(redirectTo), http.StatusSeeOther)
-		}
+		s.handleRedirect(w, r)
 	}
 }
 
-// HandleSignup renders the sign-up page on GET and creates an account on POST.
-// Invite codes are one-time-use unless they carry multiple uses.
 func (s *WebService) HandleSignup(w http.ResponseWriter, r *http.Request) {
 	// If already authenticated, redirect
 	if _, err := s.currentUser(r); err == nil {
-		redirectTo := "/"
-		if r.URL.Query().Get("redirect") != "" {
-			redirectTo = r.URL.Query().Get("redirect")
-		}
-		// For relative paths, redirect directly; for external URLs, route
-		// through the warning page.
-		if strings.HasPrefix(redirectTo, "/") && !strings.Contains(redirectTo, "://") {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else {
-			http.Redirect(w, r, "/redirect?to="+url.QueryEscape(redirectTo), http.StatusSeeOther)
-		}
+		s.handleRedirect(w, r)
 		return
 	}
 
@@ -203,27 +184,10 @@ func (s *WebService) HandleSignup(w http.ResponseWriter, r *http.Request) {
 			Secure:   CookieSecure,
 		}
 		http.SetCookie(w, cookie)
-		redirectTo := "/"
-		if r.FormValue("redirect") != "" {
-			redirectTo = r.FormValue("redirect")
-		} else if r.URL.Query().Get("redirect") != "" {
-			redirectTo = r.URL.Query().Get("redirect")
-		}
-		// For relative paths, redirect directly; for external URLs, route
-		// through the warning page unless the domain is trusted.
-		if strings.HasPrefix(redirectTo, "/") && !strings.Contains(redirectTo, "://") {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else if s.isTrustedTarget(redirectTo) {
-			http.Redirect(w, r, redirectTo, http.StatusSeeOther)
-		} else {
-			http.Redirect(w, r, "/redirect?to="+url.QueryEscape(redirectTo), http.StatusSeeOther)
-		}
+		s.handleRedirect(w, r)
 	}
 }
 
-// HandleSignout renders a confirmation page on GET and deletes the session on POST.
-// It is wrapped in requireAuth for the POST route; the GET route may show the page
-// even for anonymous visitors (the confirm form just redirects to /signin).
 func (s *WebService) HandleSignout(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
@@ -255,8 +219,6 @@ func (s *WebService) HandleSignout(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// HandleExternalRedirect shows a warning page when the user is about to
-// leave the site via an external redirect.
 func (s *WebService) HandleExternalRedirect(w http.ResponseWriter, r *http.Request) {
 	target := r.URL.Query().Get("to")
 	if target == "" {
@@ -264,7 +226,6 @@ func (s *WebService) HandleExternalRedirect(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	// Trusted targets skip the warning and are redirected directly.
 	if s.isTrustedTarget(target) {
 		http.Redirect(w, r, target, http.StatusSeeOther)
 		return
@@ -272,7 +233,6 @@ func (s *WebService) HandleExternalRedirect(w http.ResponseWriter, r *http.Reque
 
 	data, ok := s.basicViewData(w, r, "External Redirect")
 	if !ok {
-		// Not authenticated is fine — just show the warning without nav
 		data = &ViewData{Title: "External Redirect"}
 	}