Replace entire repo content with code from /root/shahikitchen-google/

infrastructure/auth/oauth-return.ts

@@ -0,0 +1,28 @@
+const OAUTH_RETURN_COOKIE = 'shahi_google_oauth_return_to';
+const DEFAULT_RETURN_PATH = '/account';
+const SAFE_PATH_PATTERN = /^\/[a-zA-Z0-9/_-]*$/;
+
+export function getOAuthReturnCookieName(): string {
+  return OAUTH_RETURN_COOKIE;
+}
+
+/** Only same-origin relative paths (optionally with query) are allowed after OAuth. */
+export function sanitizeOAuthReturnPath(value: string | null | undefined): string {
+  if (!value) return DEFAULT_RETURN_PATH;
+
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('/') || trimmed.startsWith('//') || trimmed.includes('://')) {
+    return DEFAULT_RETURN_PATH;
+  }
+
+  const withoutHash = trimmed.split('#')[0] ?? trimmed;
+  const queryIndex = withoutHash.indexOf('?');
+  const pathname = queryIndex === -1 ? withoutHash : withoutHash.slice(0, queryIndex);
+  const search = queryIndex === -1 ? '' : withoutHash.slice(queryIndex);
+
+  if (!pathname || !SAFE_PATH_PATTERN.test(pathname)) {
+    return DEFAULT_RETURN_PATH;
+  }
+
+  return `${pathname}${search}`;
+}