test(embed): cover the redirect-safety guard

[devCluna]

Extracts the post-submit redirect check into a pure isSafeRedirect(url, base) (in server/src/lib/embed.ts) and injects it into the served embed via .toString() — so the browser runs the exact function that's unit-tested, with no drift between test and shipped code.

Tests: allows absolute http(s) and relative URLs; blocks javascript: / data: / mailto: / ftp: / tel:. 35/35 pass. No behaviour change; embed output verified (syntax + logic).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved post-submission redirects for embedded forms.
  • Validates redirect destinations before navigation, allowing secure HTTP/HTTPS URLs and relative paths.
  • Blocks unsafe destinations using unsupported or potentially harmful protocols, such as javascript:, data:, mailto:, ftp:, and tel:.
  • Added coverage for valid and invalid redirect scenarios to help ensure consistent protection.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 712dcb8f-178e-4f44-82a0-47e8c0bcc480

📥 Commits

Reviewing files that changed from the base of the PR and between 5965767 and 95ca730.

📒 Files selected for processing (3)

• server/src/controllers/form.ts
• server/src/lib/embed.ts
• tests/redirect.test.ts

---

📝 Walkthrough

Walkthrough

A reusable isSafeRedirect helper now resolves redirect URLs and permits only HTTP(S) destinations. The generated embed script serializes and invokes this helper during post-submit navigation, with tests covering absolute, relative, and blocked protocols.

Changes

Safe redirect handling

Layer / File(s)	Summary
Redirect validation contract server/src/lib/embed.ts, tests/redirect.test.ts	Adds URL resolution with HTTP(S)-only validation and tests allowed relative/absolute URLs plus blocked protocols.
Embed submission integration server/src/controllers/form.ts	Injects the validator into the browser embed and uses it to guard post-submit redirects.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit with redirects bright,
Checking each URL left and right.
HTTP hops may safely run,
Strange schemes hide from the sun.
The embed now bounds its flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the added redirect-safety test coverage in the embed flow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/redirect-safety

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}