Preserve post-login redirect for customer dashboard deep links.

Unauthenticated visits to protected pages now land on /login?redirect=…, and a shared helper keeps redirect targets same-origin only.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/customer/src/pages/checkout/CheckoutFlow.tsx

@@ -2,6 +2,7 @@ import { Navigate, Outlet, useLocation } from 'react-router-dom'
 import { RouteLoader } from '@meshkee/dashboard-ui'
 import { useAuth } from '../../context/AuthContext'
 import { CheckoutStepper, type CheckoutStepId } from '../../components/checkout/CheckoutStepper'
+import { loginPathWithRedirect, safeRedirectPath } from '../../lib/redirect'
 
 /** Cart and checkout login are public. Delivery, payment, and success require auth. */
 const PUBLIC_STEPS = new Set<CheckoutStepId>(['cart', 'login'])
@@ -14,10 +15,6 @@ function stepFromPath(pathname: string): CheckoutStepId {
   return 'cart'
 }
 
-function loginRedirectPath(returnTo: string) {
-  return `/checkout/login?redirect=${encodeURIComponent(returnTo)}`
-}
-
 export function CheckoutFlow() {
   const { user, isLoading } = useAuth()
   const location = useLocation()
@@ -31,7 +28,7 @@ export function CheckoutFlow() {
   if (!isAuthenticated && !PUBLIC_STEPS.has(step)) {
     return (
       <Navigate
-        to={loginRedirectPath(location.pathname)}
+        to={loginPathWithRedirect(location.pathname, '/checkout/login')}
         replace
         state={{ from: location.pathname }}
       />
@@ -40,12 +37,9 @@ export function CheckoutFlow() {
 
   if (isAuthenticated && step === 'login') {
     const params = new URLSearchParams(location.search)
-    const fromQuery = params.get('redirect')
+    const fromQuery = safeRedirectPath(params.get('redirect'), '')
     const fromState = (location.state as { from?: string } | null)?.from
-    const destination =
-      fromQuery && fromQuery.startsWith('/') && !fromQuery.startsWith('//')
-        ? fromQuery
-        : fromState ?? '/checkout/delivery'
+    const destination = fromQuery || fromState || '/checkout/delivery'
     return <Navigate to={destination} replace />
   }