feat(auth): tell the user when the session expired

Every 401 from Auth or Core now goes through useSessionExpired: the login page
says the session expired and returns to the last page after login. App no
longer removes a token that only the browser clock calls expired, so a backend
401 is the one signal. A 403 on the profile now shows an error instead.

src/utils/auth.js

@@ -24,3 +24,16 @@ export function getValidToken() {
     }
     return token;
 }
+
+/**
+ * Returns the path when it is a path inside this app, else null. The login page uses it to go back after a
+ * session expired; "//host", "/\host" and tabs or line breaks (browsers drop them, so "/\t/host" is "//host")
+ * would leave the app, "/login" would loop.
+ */
+export function safeReturnPath(path) {
+    if (typeof path !== 'string' || !path.startsWith('/') || path.startsWith('//') || path.startsWith('/\\')
+        || /[\t\n\r]/.test(path)) {
+        return null;
+    }
+    return path === '/login' || path.startsWith('/login?') ? null : path;
+}

src/utils/auth.test.js

@@ -1,5 +1,5 @@
 import {describe, expect, it} from 'vitest';
-import {isTokenValid} from './auth.js';
+import {isTokenValid, safeReturnPath} from './auth.js';
 
 const tokenWithPayload = (payload) => {
     const encode = (obj) => btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@ -25,3 +25,14 @@ describe('isTokenValid', () => {
         expect(isTokenValid(token, now)).toBe(false);
     });
 });
+
+describe('safeReturnPath', () => {
+    it.each(['/library?status=PLAYING', '/library/220', '/settings'])('keeps the internal path %s', (path) => {
+        expect(safeReturnPath(path)).toBe(path);
+    });
+
+    it.each([undefined, null, '', 'library', '//evil.example', '/\\evil.example', '/\t/evil.example', '/\n/evil.example', 'https://evil.example', '/login', '/login?x=1'])(
+        'rejects %j', (path) => {
+            expect(safeReturnPath(path)).toBeNull();
+        });
+});