feat: redirect validation

[emlimlf]

In this PR

• Added redirect URL validation on the authentication endpoints
• Added error logging for these endpoints

Ticket

IN-973

[Copilot]

Pull request overview

Adds redirect URL validation to authentication endpoints to mitigate open-redirect risks, and introduces persistent security audit logging for invalid redirect attempts.

Changes:

• Introduces redirect validation/sanitization helpers (isValidRedirectUrl, getSafeRedirectUrl) with an allow-list for absolute redirects.
• Adds a security_audit_logs table and a repository for writing security events.
• Updates auth endpoints (login/callback/logout) and DB middleware to validate/log redirect attempts and ensure DB access is available on those routes.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
frontend/server/utils/redirect.ts	New redirect validation + sanitization helpers and allow-list logic.
frontend/server/repo/securityAudit.repo.ts	New repository for writing security audit events to Postgres.
frontend/server/middleware/database.ts	Expands DB-pool attachment to auth routes (not just chat).
frontend/server/api/auth/logout.post.ts	Adds optional returnTo handling with validation + audit logging.
frontend/server/api/auth/login.get.ts	Validates redirectTo and logs invalid attempts before setting cookie.
frontend/server/api/auth/callback.ts	Defense-in-depth validation of redirect cookie + logs possible tampering.
database/migrations/V1770789662__createSecurityAuditLogsTable.sql	Adds security_audit_logs table + indexes + event-type check constraint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.