safeNextPathFrom(): update test cases

[alxndrsn]

No description provided.

[matthew-white]

@alxndrsn, now that #1014 is merged, how are you thinking of this PR? I see new cases here that seem like they improve coverage (e.g., /login), as well as others that don't seem needed now that #1014 is merged (e.g., /login/foo/..).

[alxndrsn]

@matthew-white the /login-related tests actually indicate a proposed change of behaviour: should safeNextPathFrom() redirect next=/login to the web root?

[matthew-white]

the /login-related tests actually indicate a proposed change of behaviour

I don't quite see the change. The test has:

[ '/login',                          '/#/' ],

But isn't that what Backend already does? Or am I misunderstanding?

central-backend/lib/util/html.js

Lines 27 to 28 in bab9ef9

	if (url.origin !== envDomain || url.pathname === '/login')
	return '/#/';

should safeNextPathFrom() redirect next=/login to the web root?

No strong feelings! Unlike Frontend, Backend doesn't need special logic around next=/login. There's no problem if Backend redirects to /#/login. However, I can also see the case for keeping the logic around next the same in Frontend and Backend. Frontend redirects to /#/ for next=/login, and we could have Backend do the same. I think we should implement and test whichever way you think is best!

[alxndrsn]

@matthew-white I've updated the PR to remove irrelevant tests, and add one for path traversal.