fix(ui,test): same-origin port check + robust body read

Two follow-up nits from the Copilot review on PR #579:

- bulkRedirectAfter's same-origin guard compared refURL.Host
  (hostname:port) against c.Hostname() (hostname only). A same-origin
  Referer whose URL included the port — common in dev (localhost:3000)
  and behind some reverse proxies — was incorrectly flagged as cross-
  origin, falling back to the bare list path and losing filters. Fixed
  to refURL.Hostname() vs c.Hostname(). New subtest
  "same-origin with explicit port preserved" locks in the behaviour.

- bulk_redirect_test.go read the response body with a single
  Read into a fixed 256-byte buffer. Read is allowed to return partial
  data; if the helper output ever grew past 256 bytes or the reader
  fragmented the response, the assertion would silently truncate and
  either pass on a partial match or false-positive on a trailing
  diff. Replaced with io.ReadAll.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

internal/web/bulk_handlers.go

@@ -52,7 +52,12 @@ func bulkRedirectAfter(c *fiber.Ctx, fallbackList string, dropPanel bool) string
 
 	// Reject cross-origin Referers. Allow relative Referers (empty Host),
 	// which some clients still emit for same-origin POSTs.
-	if refURL.Host != "" && refURL.Host != c.Hostname() {
+	//
+	// Compare hostnames via url.URL.Hostname() (strips any port) so dev
+	// and proxy deployments on non-default ports (e.g. localhost:3000)
+	// are not incorrectly flagged as cross-origin against Fiber's
+	// port-less c.Hostname().
+	if refURL.Host != "" && refURL.Hostname() != c.Hostname() {
 		return fallbackList
 	}
 

internal/web/bulk_redirect_test.go

@@ -2,6 +2,7 @@
 package web
 
 import (
+	"io"
 	"net/http/httptest"
 	"testing"
 
@@ -70,6 +71,20 @@ func TestBulkRedirectAfter(t *testing.T) {
 			dropPanel:    false,
 			want:         "/users",
 		},
+		{
+			// httptest.NewRequest defaults Host to "example.com"; the
+			// absolute referer has the same hostname but an arbitrary
+			// port. Fiber's c.Hostname() is port-less, so we must
+			// compare against refURL.Hostname(), not refURL.Host — the
+			// latter would treat "example.com:3000" as a different
+			// origin and discard filters. This guards bug-fixed in the
+			// post-review follow-up.
+			name:         "same-origin with explicit port preserved",
+			referer:      "http://example.com:3000/users?ou=Eng",
+			fallbackList: "/users",
+			dropPanel:    false,
+			want:         "/users?ou=Eng",
+		},
 		{
 			name:         "unparseable referer falls back",
 			referer:      "://not-a-url",
@@ -111,11 +126,11 @@ func TestBulkRedirectAfter(t *testing.T) {
 			}
 			defer func() { _ = resp.Body.Close() }()
 
-			body := make([]byte, 256)
-			n, _ := resp.Body.Read(body)
-			got := string(body[:n])
-
-			if got != tc.want {
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				t.Fatalf("read body: %v", err)
+			}
+			if got := string(body); got != tc.want {
 				t.Errorf("got %q, want %q", got, tc.want)
 			}
 		})