From 4e969cfb999c908d013b20a7158c0c323afe4dd0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 22 Aug 2026 20:24:03 +0900
Subject: [PATCH] fix(frontend): restore return-URL safety validation and
 remove a duplicate AdminPanel render

Fixed the two TypeScript build errors currently breaking main's frontend
build (and therefore every PR's "Frontend lint, test, build" check that
carries main's tip into its CI base -- confirmed by reproducing this on a
docs-only PR whose own diff cannot have caused it).

TS6192 (all imports unused): rememberOidcReturnUrl/returnUrlFromLocation
were imported but never called. Root cause, not a lint-silencing delete:
the login button computed its own inline
"window.location.pathname + window.location.search" instead of using the
already-tested returnUrlFromLocation() utility, which additionally
includes the hash fragment and validates the target isn't an unsafe
(e.g. protocol-relative "//...") redirect target. rememberOidcReturnUrl's
storage-based fallback was never invoked either, even though
restoreOidcReturnUrl (correctly wired in main.tsx's onSigninCallback)
already reads from it when the OIDC `state` round-trip doesn't survive.
Wired both back in at the login button.

TS2322 (accessToken: string | undefined not assignable to string): the
unauthenticated/login-screen branch rendered <AdminPanel accessToken=.../>
with a token that is always undefined pre-login -- a duplicate of the
correctly-guarded AdminPanel render further down (behind
`if (!accessToken) return ...`), left over from what looks like a
copy/merge artifact. Removed the unauthenticated-branch instance; the
authenticated one is unaffected.

Verified locally with the exact CI commands: oxlint, vitest run (140
passed), and `tsc -b && vite build` all clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 frontend/src/App.tsx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 6fba0dd41..86a1e9b26 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -4610,7 +4610,11 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
             </div>
             <div className="login-controls">
               <button className="btn-primary" onClick={() => {
-                const returnUrl = window.location.pathname + window.location.search;
+                const returnUrl = returnUrlFromLocation();
+                // The OIDC `state` round-trip is the primary path (read by
+                // onSigninCallback in main.tsx); storage is the fallback for
+                // an IdP that does not preserve custom state.
+                rememberOidcReturnUrl(returnUrl);
                 void auth.signinRedirect({ state: { returnUrl } });
               }}>
                 {t("Log in")}
@@ -4620,7 +4624,6 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
               <small>Enterprise SSO Authentication</small>
             </div>
           </div>
-          {destination === "admin" ? <AdminPanel currentBrandName={brandName} onBrandNameChange={setBrandName} accessToken={accessToken} /> : null}
       </main>
         <footer className="app-footer" role="contentinfo">
           <div className="app-footer-title">