Preserve safe return paths through sign-in

internal/web/auth.go

@@ -15,6 +15,7 @@ type signInForm struct {
 	Email         string `form:"email"`
 	Password      string `form:"password"`
 	RememberEmail bool   `form:"remember_email"`
+	ReturnTo      string `form:"return_to"`
 	Errors        map[string]string
 	Message       string
 }
@@ -30,12 +31,17 @@ type activationForm struct {
 }
 
 func (app *application) signIn(w http.ResponseWriter, r *http.Request) {
+	returnTo := safeReturnPath(r.URL.Query().Get("return_to"))
 	if app.isAuthenticated(r) {
+		if returnTo != "" {
+			http.Redirect(w, r, returnTo, http.StatusSeeOther)
+			return
+		}
 		http.Redirect(w, r, app.authenticatedLandingPage(r), http.StatusSeeOther)
 		return
 	}
 	data := app.newTemplateData(r)
-	form := signInForm{Errors: make(map[string]string)}
+	form := signInForm{ReturnTo: returnTo, Errors: make(map[string]string)}
 	if cookie, err := r.Cookie("gardomatic_remembered_email"); err == nil {
 		if decoded, decodeErr := base64.RawURLEncoding.DecodeString(cookie.Value); decodeErr == nil {
 			form.Email, form.RememberEmail = string(decoded), true
@@ -52,6 +58,7 @@ func (app *application) signInPost(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	form.Email = strings.TrimSpace(form.Email)
+	form.ReturnTo = safeReturnPath(form.ReturnTo)
 	form.Errors = make(map[string]string)
 	if form.Email == "" {
 		form.Errors["email"] = "E-Mail-Adresse ist erforderlich."
@@ -99,6 +106,10 @@ func (app *application) signInPost(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, webPath("activate"), http.StatusSeeOther)
 		return
 	}
+	if form.ReturnTo != "" {
+		http.Redirect(w, r, form.ReturnTo, http.StatusSeeOther)
+		return
+	}
 	http.Redirect(w, r, pathWithQuery(webPath("gardens"), "auto", 1), http.StatusSeeOther)
 }