Improve OAuth

app/login/page.tsx

···
 }: {
   searchParams: Promise<{ error?: string; returnUrl?: string }>;
 }) {
-  const { error, returnUrl = "/" } = await searchParams;
+  const params = await searchParams;
+  const error = params.error
+  const returnUrl = params.returnUrl && params.returnUrl.startsWith('/') ? params.returnUrl : '/';
 
   return (
     <div className="LoginPage">

app/oauth/callback/route.ts

···
     if (state) {
       try {
         const parsed = JSON.parse(state);
-        if (parsed.returnUrl && typeof parsed.returnUrl === "string") {
+        if (parsed.returnUrl && typeof parsed.returnUrl === "string" && parsed.returnUrl.startsWith('/')) {
           returnUrl = parsed.returnUrl;
         }
       } catch {
···
     session.did = oauthSession.did;
     await session.save();
 
-    // Redirect to returnUrl
+    // Redirect to returnUrl: We have ensured the return URL is relative above:
     const redirectUrl = new URL(returnUrl, baseUrl);
     return NextResponse.redirect(redirectUrl);
   } catch (err) {