Redirect to original URL after ATProto login

Store the ?next= param through the OAuth round-trip via the session
so collaborators land on their invite URL after signing in.

Co-Authored-By: Claude Sonnet 4.6 <[e-mail]>

internal/handler/atproto.go

···
 
 // ATProtoLoginPage renders the handle-entry form.
 func (h *Handler) ATProtoLoginPage(w http.ResponseWriter, r *http.Request) {
-	h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky"})
+	next := r.URL.Query().Get("next")
+	h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Next: next})
 }
 
 // ATProtoLoginSubmit starts the ATProto OAuth flow.
 func (h *Handler) ATProtoLoginSubmit(w http.ResponseWriter, r *http.Request) {
 	handle := strings.TrimSpace(r.FormValue("handle"))
+	next := r.FormValue("next")
 	if handle == "" {
-		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Handle is required"})
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Handle is required", Next: next})
 		return
 	}
 
···
 	did, err := atproto.ResolveHandle(handle)
 	if err != nil {
 		log.Printf("ATProto: resolve handle %s: %v", handle, err)
-		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not resolve handle — check it and try again"})
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not resolve handle — check it and try again", Next: next})
 		return
 	}
 
 	pds, err := atproto.ResolvePDS(did)
 	if err != nil {
 		log.Printf("ATProto: resolve PDS for %s: %v", did, err)
-		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not reach your PDS"})
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not reach your PDS", Next: next})
 		return
 	}
 
 	meta, err := atproto.FetchAuthServerMeta(pds)
 	if err != nil {
 		log.Printf("ATProto: fetch auth meta from %s: %v", pds, err)
-		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "PDS does not support ATProto OAuth"})
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "PDS does not support ATProto OAuth", Next: next})
 		return
 	}
 
···
 	sess.Values["atproto_did"] = did
 	sess.Values["atproto_handle"] = handle
 	sess.Values["atproto_pds_url"] = pds
+	if next != "" {
+		sess.Values["atproto_next"] = next
+	}
 	sess.Save(r, w)
 
 	authURL := meta.AuthorizationEndpoint + "?client_id=" + url.QueryEscape(clientID) + "&request_uri=" + url.QueryEscape(parResp.RequestURI)
···
 	tokenEndpoint, _ := sess.Values["atproto_token_endpoint"].(string)
 	expectedDID, _ := sess.Values["atproto_did"].(string)
 	pdsURL, _ := sess.Values["atproto_pds_url"].(string)
+	next, _ := sess.Values["atproto_next"].(string)
 
 	// Clean up session state
 	delete(sess.Values, "atproto_state")
···
 	delete(sess.Values, "atproto_token_endpoint")
 	delete(sess.Values, "atproto_did")
 	delete(sess.Values, "atproto_pds_url")
+	delete(sess.Values, "atproto_next")
 
 	// 2. Exchange code for tokens
 	kp, err := dpop.UnmarshalPrivate([]byte(keyJSON))
···
 
 	auth.SetUserID(w, r, user.ID)
 	sess.Save(r, w)
+
+	// Redirect to the originally requested URL, or home.
+	// Only allow local paths to prevent open redirect.
+	if next != "" && strings.HasPrefix(next, "/") {
+		http.Redirect(w, r, next, http.StatusSeeOther)
+		return
+	}
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }

internal/handler/handler.go

···
 	Error       string
 	Description string
 	OGImage     string
+	Next        string
 }
 
 // DocumentEditData is passed to document_edit.html.

templates/atproto_login.html

···
     <div class="alert alert-error">{{.Error}}</div>
     {{end}}
     <form method="post" action="/auth/atproto" class="auth-form">
+        {{if .Next}}<input type="hidden" name="next" value="{{.Next}}">{{end}}
         <label>
             <input type="text" name="handle" placeholder="Bluesky username or custom domain name" required autofocus
                    autocomplete="username" spellcheck="false" autocorrect="off" autocapitalize="off">