The redirect check that trusts a leading slash

After a successful login, the API redirects the user back to the page they originally asked for. The target comes from a `?next=` query parameter, so it is user-controlled. A teammate asked the AI assistant: "Write `resolveRedirect(target, fallback)` for our login endpoint. Only allow redirects to pages on our own site; anything else should go to the fallback." The code came back with tests that pass. The contract promised by the docstring: - `resolveRedirect(target, fallback)` returns `target` when it is a local path on this site, and `fallback` otherwise. - A missing, empty or whitespace-only `target` falls back. - Absolute URLs to other hosts (`https://evil.example`) must never be returned. - `isLocalPath(url)` is the predicate behind it: `true` only for paths that the browser will resolve on the current origin. Keep in mind how a browser interprets a `Location` header: it does not only look for `http://`. Review the code before it ships.

import { describe, it, expect } from "@debunk/harness";
import { resolveRedirect, isLocalPath } from "./code";

describe("resolveRedirect", () => {
  it("keeps a local path", () => {
    expect(resolveRedirect("/settings/profile?tab=security")).toBe("/settings/profile?tab=security");
  });

  it("falls back for an absolute URL to another host", () => {
    expect(resolveRedirect("https://evil.example/login")).toBe("/dashboard");
    expect(isLocalPath("http://evil.example")).toBe(false);
  });

  it("falls back when the target is missing", () => {
    expect(resolveRedirect(null)).toBe("/dashboard");
    expect(resolveRedirect("   ", "/home")).toBe("/home");
  });
});