Merge remote-tracking branch 'origin/main' into chore/update-dependencies-95

# Conflicts:
#	package-lock.json
#	package.json

Author: dobby-coder[bot]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
   - name: Report a security vulnerability
     url: https://github.com/encryption4all/postguard-business/security/advisories/new

.github/workflows/ci.yml

@@ -82,7 +82,7 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
-      - run: npx vitest run
+      - run: npx vitest run --coverage
         env:
           DATABASE_URL: postgres://testuser:testpassword@localhost:5432/postguard_business_test
       - run: npx playwright install --with-deps

.gitignore

@@ -22,6 +22,9 @@ Thumbs.db
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 
+# Vitest coverage
+/coverage
+
 # Playwright
 test-results
 /playwright-report

.prettierignore

@@ -8,3 +8,4 @@ bun.lockb
 # Miscellaneous
 /static/
 /drizzle/
+/coverage/

package-lock.json

@@ -31,6 +31,7 @@
 		"@sveltejs/kit": "^2.69.0",
 		"@sveltejs/vite-plugin-svelte": "^7.1.2",
 		"@types/node": "^26.1.0",
+		"@vitest/coverage-v8": "^4.1.9",
 		"drizzle-kit": "^0.31.10",
 		"drizzle-orm": "^0.45.2",
 		"eslint": "^10.6.0",

package.json

@@ -11,7 +11,7 @@
 	showRegister={data.marketingFlags.registration}
 	auth={data.auth}
 />
-<main>
+<main id="main-content">
 	{@render children()}
 </main>
 <Footer />

src/routes/(marketing)/+layout.svelte

@@ -1,8 +1,9 @@
 import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
+import { safeRedirect } from './safe-redirect';
 
 export const load: PageServerLoad = async ({ locals, url }) => {
 	if (locals.session?.userType === 'org') {
-		redirect(303, url.searchParams.get('redirect') ?? '/portal/dashboard');
+		redirect(303, safeRedirect(url.searchParams.get('redirect')));
 	}
 };

src/routes/auth/login/+page.server.ts

@@ -8,14 +8,16 @@
 	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
 	import { resolve } from '$app/paths';
+	import { safeRedirect } from './safe-redirect';
 	import type { PageData } from './$types';
 
 	let { data }: { data: PageData } = $props();
 
-	const redirectTo = $derived(page.url.searchParams.get('redirect') ?? '/portal/dashboard');
+	const redirectTo = $derived(page.url.searchParams.get('redirect'));
 
 	function handleSuccess() {
-		goto(resolve(redirectTo as '/portal/dashboard'));
+		// The `redirect` param is attacker-controlled — validate it before navigating.
+		goto(resolve(safeRedirect(redirectTo) as '/portal/dashboard'));
 	}
 </script>
 

src/routes/auth/login/+page.svelte

@@ -0,0 +1,40 @@
+// The post-login `redirect` query param is attacker-controlled, so it must
+// never be handed to `redirect()`/`goto()` without validation — otherwise it
+// is an open redirect (an attacker can send `?redirect=https://evil.example`
+// or the protocol-relative `?redirect=//evil.example` to bounce a logged-in
+// user off-site). Only same-origin, path-absolute targets are allowed.
+
+export const DEFAULT_REDIRECT = '/portal/dashboard';
+
+/**
+ * True if `value` contains any C0 control character (U+0000–U+001F, incl.
+ * TAB/LF/CR). Browsers strip these from URLs before navigating, so a value
+ * like `/\t/evil.example` or `/\n//evil.example` would slip past the slash
+ * checks below and then normalise to a protocol-relative, off-origin URL.
+ * Strip-then-parse is the classic open-redirect bypass, so we reject any such
+ * value up front. (Expressed as a char-code scan to keep literal control
+ * characters out of the source.)
+ */
+function hasControlChar(value: string): boolean {
+	for (let i = 0; i < value.length; i++) {
+		if (value.charCodeAt(i) <= 0x1f) return true;
+	}
+	return false;
+}
+
+/**
+ * Return a safe post-login redirect target. A value is only accepted when it
+ * begins with a single `/` (a same-origin absolute path). Everything else —
+ * empty/missing values, values containing control characters, absolute URLs
+ * (`https://…`), protocol-relative URLs (`//host`) and the backslash variant
+ * browsers normalise to them (`/\host`) — falls back to {@link DEFAULT_REDIRECT}.
+ */
+export function safeRedirect(target: string | null | undefined): string {
+	if (!target) return DEFAULT_REDIRECT;
+	if (hasControlChar(target)) return DEFAULT_REDIRECT;
+	if (!target.startsWith('/')) return DEFAULT_REDIRECT;
+	// Reject protocol-relative URLs. Browsers treat `\` as `/`, so `/\host`
+	// escapes the origin just like `//host` does.
+	if (target[1] === '/' || target[1] === '\\') return DEFAULT_REDIRECT;
+	return target;
+}