Merge pull request #313 from spoo-me/fix/device-login-next-redirect

fix(auth): send logged-out device-auth users to /login instead of the landing root

Author: Zingzy

routes/auth/device.py

@@ -131,7 +131,8 @@ async def device_login(
         if redirect_uri:
             params["redirect_uri"] = redirect_uri
         next_url = f"/auth/device/login?{urlencode(params)}"
-        return RedirectResponse(f"/?next={quote(next_url)}", status_code=302)
+        # /login is the only frontend surface that resumes ?next= after auth.
+        return RedirectResponse(f"/login?next={quote(next_url)}", status_code=302)
 
     # Check for existing active grant (auto-approve)
     grant = await grant_repo.find_active_grant(user.user_id, app_id)

tests/integration/test_device_auth.py

@@ -290,7 +290,7 @@ def test_device_login_unauthenticated_redirects(
     )
     assert resp.status_code == 302
     loc = resp.headers["location"]
-    assert "/?next=" in loc
+    assert loc.startswith("/login?next=")
     assert "spoo-snap" in loc
     assert "abc" in loc
     # The PKCE challenge must survive the login round-trip