Phase 8

src/features/auth/actions/register.ts

@@ -6,6 +6,7 @@ import { prisma } from "@/lib/db/prisma";
 import { registerSchema } from "@/features/auth/schemas";
 import { checkRateLimit } from "@/lib/security/rate-limit";
 import { getRequestIp } from "@/lib/security/request-ip";
+import { safeRedirectPath } from "@/lib/utils/safe-redirect";
 
 export interface RegisterResult {
   success: boolean;
@@ -75,7 +76,8 @@ export async function registerAction(formData: FormData): Promise<RegisterResult
     },
   });
 
-  await signIn("credentials", { email, password, redirectTo: "/home" });
+  const redirectTo = safeRedirectPath(formData.get("callbackUrl")?.toString(), "/home");
+  await signIn("credentials", { email, password, redirectTo });
 
   return { success: true };
 }

src/features/auth/components/accept-invitation-form.tsx

@@ -39,8 +39,8 @@ export function AcceptInvitationForm({ token, businessName }: { token: string; b
   return (
     <form onSubmit={handleSubmit(onSubmit)} noValidate className="space-y-4">
       <p className="text-muted text-sm">
-        You&apos;ve been invited to join <span className="text-ink font-bold">{businessName}</span> on NextChair. Set
-        a password to finish setting up your account.
+        You&apos;ve been invited to join <span className="text-ink font-bold">{businessName}</span>. Set a password
+        to finish setting up your account.
       </p>
       <Input
         label="Password"

src/features/auth/components/register-form.tsx

@@ -2,14 +2,18 @@
 
 import { zodResolver } from "@hookform/resolvers/zod";
 import Link from "next/link";
+import { useSearchParams } from "next/navigation";
 import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { registerAction } from "@/features/auth/actions/register";
 import { registerSchema, type RegisterInput } from "@/features/auth/schemas";
+import { safeRedirectPath } from "@/lib/utils/safe-redirect";
 
 export function RegisterForm() {
+  const searchParams = useSearchParams();
+  const callbackUrl = safeRedirectPath(searchParams.get("callbackUrl"), "/home");
   const [formError, setFormError] = useState<string | null>(null);
 
   const {
@@ -25,6 +29,7 @@ export function RegisterForm() {
     setFormError(null);
     const formData = new FormData();
     Object.entries(data).forEach(([key, value]) => formData.set(key, value ?? ""));
+    formData.set("callbackUrl", callbackUrl);
 
     const result = await registerAction(formData);
 
@@ -111,7 +116,7 @@ export function RegisterForm() {
 
       <p className="text-muted mt-10 text-center text-sm">
         Already have an account?{" "}
-        <Link href="/sign-in" className="border-ink text-ink border-b font-bold">
+        <Link href={`/sign-in?callbackUrl=${encodeURIComponent(callbackUrl)}`} className="border-ink text-ink border-b font-bold">
           Log in
         </Link>
       </p>

src/features/auth/components/sign-in-form.tsx

@@ -10,10 +10,11 @@ import { useForm } from "react-hook-form";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { signInSchema, type SignInInput } from "@/features/auth/schemas";
+import { safeRedirectPath } from "@/lib/utils/safe-redirect";
 
 export function SignInForm() {
   const searchParams = useSearchParams();
-  const callbackUrl = searchParams.get("callbackUrl") ?? "/home";
+  const callbackUrl = safeRedirectPath(searchParams.get("callbackUrl"), "/home");
   const [formError, setFormError] = useState<string | null>(null);
 
   const {
@@ -91,7 +92,7 @@ export function SignInForm() {
 
       <p className="text-muted mt-10 text-center text-sm">
         Don&apos;t have an account?{" "}
-        <Link href="/register" className="border-ink text-ink border-b-2 font-bold">
+        <Link href={`/register?callbackUrl=${encodeURIComponent(callbackUrl)}`} className="border-ink text-ink border-b-2 font-bold">
           Create one
         </Link>
       </p>