refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

This commit is contained in:

Brummel

2026-05-04 18:36:10 +02:00

parent 3d67cbc1c8

commit 2c6062a53e

43 changed files with 313 additions and 266 deletions

									
										scripts/dictate.sh
									
		+1
		-1
	
												View File
												
				@@ -83,7 +83,7 @@ show_case() {

				    fi

				    echo

				    echo "Browse: $SERVER_URL/web/cases"

				    echo "Browse: $SERVER_URL/cases"

				}

				# Record + upload for the given case, then display the case state.