update: restore past path status after authorized from login page

[Myxogastria0808]

No description provided.

[Copilot]

Pull request overview

Updates the frontend authentication flow to preserve and restore the user’s previous path when redirecting through the login page, while also removing the now-redundant VITE_REDIRECT_URL configuration.

Changes:

• Removed VITE_REDIRECT_URL from setup generation, example env files, and GitHub Actions workflows.
• Added redirect query-param handling via a new redirect helper and updated SessionCheck / Login to pass and consume the redirect path.
• Adjusted UI behavior to show a “ログイン” link in the header when the session check is not successful.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
setup/src/types.ts	Removes viteRedirectUrl from typed frontend config.
setup/src/index.ts	Stops writing VITE_REDIRECT_URL into the frontend .env.
setup/src/functions.ts	Stops loading/printing/propagating VITE_REDIRECT_URL.
products/frontend/src/routes/Share/components/Header/index.tsx	Removes auto-redirect on session error; shows login link when not authenticated.
products/frontend/src/routes/SessionCheck/index.tsx	Adds redirect-to-login with redirect param and post-auth redirect handling.
products/frontend/src/routes/Profile/components/SocialLink/index.tsx	Uses VITE_CLIENT_URL for OAuth callback URLs to /profile.
products/frontend/src/routes/Login/index.tsx	Builds OAuth callback URL using redirect query param and helper functions.
products/frontend/src/lib/redirect.ts	New helper for validating redirect paths and building callback URLs.
products/frontend/.env.example	Removes VITE_REDIRECT_URL from example env.
.github/workflows/preview-frontend.yaml	Removes VITE_REDIRECT_URL from workflow env.
.github/workflows/deploy-frontend.yaml	Removes VITE_REDIRECT_URL from workflow env.
.env.example	Removes VITE_REDIRECT_URL from root example env.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

redirect に渡しているのが location.pathname のみなので、元のURLにクエリ（location.search）やハッシュ（location.hash）が付いていた場合に復元できません。pathname + search + hash（または location.pathname + location.search）をまとめてエンコードして渡すようにすると、PRタイトルの「past path status」をより正確に復元できます。

Suggested change

	// その際、現在のパスをredirectクエリパラメータとして渡す
	navigate(`/login?redirect=${encodeURIComponent(location.pathname)}`, { replace: true });
	// その際、現在のパス（クエリ・ハッシュを含む）をredirectクエリパラメータとして渡す
	navigate(
	`/login?redirect=${encodeURIComponent(location.pathname + location.search + location.hash)}`,
	{ replace: true },
	);

[Copilot]

console.log が複数残っており、本番環境で不要なログ出力（場合によってはURLクエリ等の情報露出）になります。デバッグ用途なら削除するか、開発環境のみで出力するように条件分岐してください。

Suggested change

	console.log('Login Location:', location.search);
	// 2. redirectクエリパラメータを取得
	// status: /some/safe/path
	const redirectPath = getRedirectPath(location.search);
	console.log('Login Redirect Path:', redirectPath);
	// 3. callbackURLを構築
	// status: import.meta.env.VITE_CLIENT_URL + /some/safe/path
	const callbackURL = buildCallbackURL(redirectPath);
	console.log('Login Callback URL:', callbackURL);
	// 2. redirectクエリパラメータを取得
	// status: /some/safe/path
	const redirectPath = getRedirectPath(location.search);
	// 3. callbackURLを構築
	// status: import.meta.env.VITE_CLIENT_URL + /some/safe/path
	const callbackURL = buildCallbackURL(redirectPath);
	if (import.meta.env.DEV) {
	console.log('Login Location:', location.search);
	console.log('Login Redirect Path:', redirectPath);
	console.log('Login Callback URL:', callbackURL);
	}

[Copilot]

コメントの「status: import.meta.env.VITE_CLIENT_URL + /some/safe/path」と実装（buildCallbackURL は VITE_CLIENT_URL に redirect クエリを付与して返す）に差異があります。将来の保守で混乱しやすいので、コメントを実装に合わせて修正するか、意図が「パスへ直接遷移」なら関数側の戻り値を合わせてください。

Suggested change

	// status: import.meta.env.VITE_CLIENT_URL + /some/safe/path
	// status: import.meta.env.VITE_CLIENT_URL + '?redirect=' + redirectPath

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 587a6c2506

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject scheme-relative redirect targets

getRedirectPath only checks startsWith('/'), so a scheme-relative value like redirect=//evil.com is treated as valid. Later SessionCheck calls navigate(redirectPath), and react-router’s browser history will fall back to window.location.assign when pushState rejects a cross-origin URL, turning that into a full external redirect. That means a crafted login URL can bounce users to an attacker-controlled site after auth. Consider rejecting paths that start with // (and similar variants) or validating against a same-origin allowlist.

Useful? React with 👍 / 👎.