Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/handlers/auth.go

@@ -2,19 +2,56 @@ package handlers
 
 import (
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
+	"unicode"
 
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/logfield"
+	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
+// loginDestination returns where a successful login sends the
+// browser: next when it is a path on this site, otherwise "/", which
+// leads to the webhook list.
+//
+// A browser reads "//host" as another site, reads "\" as "/", and
+// drops tabs and newlines before reading at all. So the value must
+// start with exactly one "/" and hold no "\" or control character
+// anywhere: http.Redirect cleans "/a/../\host" down to "/\host". It
+// is checked after percent-decoding, so an encoded form of any of
+// these is refused too.
+func loginDestination(next string) string {
+	if len(next) > middleware.MaxNextBytes {
+		return "/"
+	}
+
+	decoded, err := url.PathUnescape(next)
+	if err != nil ||
+		!strings.HasPrefix(decoded, "/") ||
+		strings.HasPrefix(decoded, "//") ||
+		strings.Contains(decoded, `\`) ||
+		strings.ContainsFunc(decoded, unicode.IsControl) {
+		return "/"
+	}
+
+	return next
+}
+
 // HandleLoginPage returns a handler for the login page (GET)
 func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		next := loginDestination(
+			r.URL.Query().Get(middleware.NextParam),
+		)
+
 		// Check if already logged in
 		sess, err := h.session.Get(r)
 		if err == nil && h.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/", http.StatusSeeOther)
+			http.Redirect( //nolint:gosec // checked by loginDestination
+				w, r, next, http.StatusSeeOther,
+			)
 
 			return
 		}
@@ -22,6 +59,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 		// Render login page
 		data := map[string]any{
 			tmplKeyError: "",
+			tmplKeyNext:  next,
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -36,7 +74,7 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
-			http.Error(w, "Bad request", http.StatusBadRequest)
+			h.renderError(w, r, http.StatusBadRequest)
 
 			return
 		}
@@ -77,8 +115,13 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 			"user_id", user.ID,
 		)
 
-		// Redirect to home page
-		http.Redirect(w, r, "/", http.StatusSeeOther)
+		// The form value is the client's to set, so it is checked
+		// again here rather than trusted from the rendered page.
+		http.Redirect( //nolint:gosec // checked by loginDestination
+			w, r,
+			loginDestination(r.PostFormValue(middleware.NextParam)),
+			http.StatusSeeOther,
+		)
 	}
 }
 
@@ -91,10 +134,12 @@ func (h *Handlers) renderLoginError(
 ) {
 	data := map[string]any{
 		tmplKeyError: msg,
+		tmplKeyNext: loginDestination(
+			r.PostFormValue(middleware.NextParam),
+		),
 	}
 
-	w.WriteHeader(status)
-	h.renderTemplate(w, r, "login.html", data)
+	h.renderTemplateStatus(w, r, "login.html", data, status)
 }
 
 // authenticateUser looks up and verifies a user's credentials.
@@ -103,9 +148,10 @@ func (h *Handlers) renderLoginError(
 // The credential check runs BEFORE any rate-limit budget is
 // consulted, and only a failed check spends budget. That is what
 // keeps the single administrative path reachable: behind the reverse
-// proxy this deployment requires, with TRUSTED_PROXIES unset, every
-// client shares one bucket, so a limiter spent on arrival lets any
-// stranger deny the operator's own correct password indefinitely.
+// proxy this deployment requires, when TRUSTED_PROXIES does not cover
+// it, every client shares one bucket, so a limiter spent on arrival
+// lets any stranger deny the operator's own correct password
+// indefinitely.
 //
 // Verifying first means every login POST costs an Argon2id hash, so
 // the work is taken under a bounded number of verification slots.
@@ -165,11 +211,7 @@ func (h *Handlers) authenticateUser(
 
 	valid, err := database.VerifyPassword(password, user.Password)
 	if err != nil {
-		h.log.Error("failed to verify password", "error", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
+		h.serverError(w, r, "failed to verify password", err)
 
 		return user, err
 	}
@@ -226,7 +268,7 @@ func (h *Handlers) rejectLogin(
 	)))
 	h.renderLoginError(
 		w, r,
-		"Too many failed login attempts. Please try again later.",
+		"Too many failed sign-in attempts. Please try again later.",
 		http.StatusTooManyRequests,
 	)
 }
@@ -241,24 +283,14 @@ func (h *Handlers) createAuthenticatedSession(
 ) error {
 	oldSess, err := h.session.Get(r)
 	if err != nil {
-		h.log.Error("failed to get session", "error", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
+		h.serverError(w, r, "failed to get session", err)
 
 		return err
 	}
 
 	sess, err := h.session.Regenerate(r, w, oldSess)
 	if err != nil {
-		h.log.Error(
-			"failed to regenerate session", "error", err,
-		)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
+		h.serverError(w, r, "failed to regenerate session", err)
 
 		return err
 	}
@@ -267,11 +299,7 @@ func (h *Handlers) createAuthenticatedSession(
 
 	err = h.session.Save(r, w, sess)
 	if err != nil {
-		h.log.Error("failed to save session", "error", err)
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
+		h.serverError(w, r, "failed to save session", err)
 
 		return err
 	}
@@ -304,7 +332,9 @@ func (h *Handlers) HandleLogout() http.HandlerFunc {
 			)
 		}
 
-		// Redirect to login page
-		http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+		http.Redirect(
+			w, r, withNotice("/pages/login", signedOut),
+			http.StatusSeeOther,
+		)
 	}
 }