refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL without disambiguating anything. All 16 browser routes move to the apex (/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are unchanged. A new /->>/cases redirect closes the apex 404. The open-redirect guard in magic.rs and case_actions.rs flips from a positive whitelist (starts_with("/web/")) to a deny-list: same-origin path, not protocol-relative, not under /api/, no \. The /api/ exclusion is now load-bearing and covered by tests. Pre-production: no transition redirects.
2026-05-04 18:36:10 +02:00
parent 3d67cbc1c8
commit 2c6062a53e
43 changed files with 313 additions and 266 deletions
@@ -28,7 +28,7 @@ pub fn form_post<U: AsRef<str>>(uri: U, cookie: &str, body: impl Into<String>) -

 /// Form-urlencoded POST that appends `csrf_token={csrf}` automatically.
 /// Pass an empty `extra_body` when the form has no other fields
-/// (e.g. POST /web/cases/{id}/close).
+/// (e.g. POST /cases/{id}/close).
 pub fn csrf_form_post<U: AsRef<str>>(
    uri: U,
    cookie: &str,
@@ -43,7 +43,7 @@ pub fn csrf_form_post<U: AsRef<str>>(
    form_post(uri, cookie, body)
 }

-/// GET with a session cookie — authenticated `/web/*` pages.
+/// GET with a session cookie — authenticated `/*` pages.
 pub fn get_with_cookie<U: AsRef<str>>(uri: U, cookie: &str) -> Request<Body> {
    Request::builder()
        .method("GET")