Magic-link sign in UI and APIs

lib/safeInternalPath.ts

@@ -0,0 +1,7 @@
+/** Allow only same-origin relative paths for open redirects after auth. */
+export function safeInternalPath(next: string | null | undefined): string {
+  if (!next || !next.startsWith("/") || next.startsWith("//")) {
+    return "/";
+  }
+  return next;
+}