Logging in returns to the page that was asked for (closes #384)

RequireAuth now sends a logged-out GET to /pages/login with its path
and query in a `next` parameter when they fit in 2048 bytes, the same
limit the login page applies. The login form carries it as a hidden
field, and a successful login redirects there when it is a path on
this site; anything else, plain or percent-encoded, goes to `/`, which
leads to the webhook list. A browser already logged in that opens the
login page goes to the same place. The navigation bar on the login
page no longer links to the login page.

Model: opus-5-5

internal/server/routes_test.go

@@ -680,6 +680,44 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
 	)
 }
 
+// TestPagesLogin_ReturnsToTheRequestedPage is
+// https://git.eeqj.de/sneak/webhooker/issues/384: a page opened while
+// logged out leads to the login page, and logging in from there lands
+// on that page, query included.
+func TestPagesLogin_ReturnsToTheRequestedPage(t *testing.T) {
+	t.Parallel()
+
+	const (
+		username = "operator"
+		password = "correct-horse-battery-staple"
+	)
+
+	env := newTestEnv(t)
+	userID, _ := env.seedUser(t, username, password)
+	asked := "/source/" + env.seedWebhook(t, userID).ID + "/logs?page=2"
+
+	bounced := env.get(asked, nil)
+	require.Equal(t, http.StatusSeeOther, bounced.Code)
+
+	loginPage := bounced.Header().Get("Location")
+
+	match := regexp.MustCompile(`name="next" value="([^"]*)"`).
+		FindStringSubmatch(env.get(loginPage, nil).Body.String())
+	require.Len(t, match, 2, "the login form must carry the page")
+
+	token, cookies := env.csrfFrom(t, loginPage, nil)
+
+	form := url.Values{}
+	form.Set("csrf_token", token)
+	form.Set("username", username)
+	form.Set("password", password)
+	form.Set("next", html.UnescapeString(match[1]))
+
+	w := env.post("/pages/login", form, cookies)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(t, asked, w.Header().Get("Location"))
+}
+
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -830,7 +868,10 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 
 	anon := env.get(path, nil)
 	assert.Equal(t, http.StatusSeeOther, anon.Code)
-	assert.Equal(t, "/pages/login", anon.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next="+url.QueryEscape(path),
+		anon.Header().Get("Location"),
+	)
 }
 
 // TestDeliveryReplay_PostOnlyAndCSRFProtected walks the replay action