Return to the requested URL after logging in (#24637)

When an unauthenticated user opens a deep link, carry the requested
path through the login page in a redirect query param and return to it
after a successful login instead of always going to the home page.
Only same-origin targets are honored.


Claude-Session: https://claude.ai/code/session_011CFGjgYURSRTpXBaxp1Dq7

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

web/src/components/auth/AuthForm.tsx

@@ -2,7 +2,7 @@
 
 import * as React from "react";
 
-import { baseUrl } from "../../api/baseUrl";
+import { getPostLoginUrl } from "@/api/auth-redirect";
 import { cn } from "@/lib/utils";
 import { Input } from "@/components/ui/input";
 import { Button } from "@/components/ui/button";
@@ -69,7 +69,7 @@ export function UserAuthForm({ className, ...props }: UserAuthFormProps) {
         username: profileRes.data.username,
         role: profileRes.data.role || "viewer",
       });
-      window.location.href = baseUrl;
+      window.location.href = getPostLoginUrl();
     } catch (error) {
       if (axios.isAxiosError(error)) {
         const err = error as AxiosError;

web/src/components/auth/ProtectedRoute.tsx

@@ -3,10 +3,10 @@ import { Navigate, Outlet } from "react-router-dom";
 import { AuthContext } from "@/context/auth-context";
 import ActivityIndicator from "../indicators/activity-indicator";
 import {
+  getLoginUrl,
   isRedirectingToLogin,
   setRedirectingToLogin,
 } from "@/api/auth-redirect";
-import { baseUrl } from "@/api/baseUrl";
 
 export default function ProtectedRoute({
   requiredRoles,
@@ -25,7 +25,7 @@ export default function ProtectedRoute({
       !isRedirectingToLogin()
     ) {
       setRedirectingToLogin(true);
-      window.location.href = `${baseUrl}login`;
+      window.location.href = getLoginUrl();
     }
   }, [auth.isLoading, auth.isAuthenticated, auth.user]);