fix(ui): shared safe-next validation, no lockout on success, logout origin check, tab/feed polish

src/hooks.server.ts

@@ -1,11 +1,11 @@
 import { dev } from '$app/environment';
+import { SAFE_NEXT } from '$lib/server/auth/safe-next';
 import { SESSION_COOKIE, verifySessionToken } from '$lib/server/auth/session';
 import { getApp } from '$lib/server/app';
 import { error, redirect, type Handle } from '@sveltejs/kit';
 
 const PUBLIC_PATHS = new Set(['/login']);
 const ALLOWED_WHILE_PASSWORD_CHANGE = new Set(['/me/password', '/logout']);
-const SAFE_NEXT = /^\/([^/\\]|$)/;
 
 export const handle: Handle = async ({ event, resolve }) => {
 	const app = await getApp();
@@ -28,7 +28,8 @@ export const handle: Handle = async ({ event, resolve }) => {
 
 	if (!user) {
 		if (!PUBLIC_PATHS.has(path)) {
-			const next = SAFE_NEXT.test(path) ? `?next=${encodeURIComponent(path)}` : '';
+			const fullPath = event.url.pathname + event.url.search;
+			const next = SAFE_NEXT.test(path) ? `?next=${encodeURIComponent(fullPath)}` : '';
 			redirect(303, `/login${next}`);
 		}
 	} else {

src/lib/components/TabBar.svelte

@@ -12,11 +12,22 @@
 		{ href: '/me', label: 'Me', icon: '👤' }
 	]);
 
-	const isActive = (href: string) =>
-		href === '/' ? page.url.pathname === '/' : page.url.pathname.startsWith(href);
+	const isActive = (href: string) => {
+		const path = page.url.pathname;
+		if (href === '/') {
+			return (
+				path === '/' ||
+				(path.startsWith('/expenses/') && path !== '/expenses/new') ||
+				path.startsWith('/settlements/')
+			);
+		}
+		if (href === '/expenses/new') return path === '/expenses/new';
+		return path.startsWith(href);
+	};
 </script>
 
 <nav
+	aria-label="Primary"
 	class="fixed inset-x-0 bottom-0 z-10 border-t border-gray-200 bg-white pb-[env(safe-area-inset-bottom)]"
 >
 	<ul class="mx-auto flex max-w-lg justify-around">

src/lib/server/auth/rate-limit.ts

@@ -34,4 +34,8 @@ export class RateLimiter {
 		this.hits.set(key, recent);
 		return true;
 	}
+
+	reset(key: string): void {
+		this.hits.delete(key);
+	}
 }

src/lib/server/auth/safe-next.ts

@@ -0,0 +1,5 @@
+export const SAFE_NEXT = /^\/([^/\\]|$)/;
+
+export function safeNext(next: string | null, fallback = '/'): string {
+	return next !== null && SAFE_NEXT.test(next) ? next : fallback;
+}

src/routes/+page.server.ts

@@ -22,17 +22,18 @@ export const load: PageServerLoad = ({ locals }) => {
 		...ledger.listExpenses().map((e): FeedItem => {
 			const paid = e.paidBy === me.id ? e.amountCents : 0;
 			const share = e.shares[me.id] ?? 0;
+			const peopleCount = Object.keys(e.shares).length;
 			return {
 				kind: 'expense', id: e.id, date: e.date, createdAt: e.createdAt,
 				title: e.description,
-				subtitle: `${name(e.paidBy)} paid · ${Object.keys(e.shares).length} people`,
+				subtitle: `${name(e.paidBy)} paid · ${peopleCount} ${peopleCount === 1 ? 'person' : 'people'}`,
 				amountCents: e.amountCents, myDeltaCents: paid - share, hasPhoto: !!e.photo
 			};
 		}),
 		...ledger.listSettlements().map((s): FeedItem => ({
 			kind: 'settlement', id: s.id, date: s.date, createdAt: s.createdAt,
 			title: `${name(s.from)} paid ${name(s.to)}`,
-			subtitle: s.note ?? 'Settlement',
+			subtitle: s.note?.trim() || 'Settlement',
 			amountCents: s.amountCents,
 			myDeltaCents: s.from === me.id ? s.amountCents : s.to === me.id ? -s.amountCents : 0,
 			hasPhoto: false

src/routes/login/+page.server.ts

@@ -1,4 +1,5 @@
 import { dev } from '$app/environment';
+import { safeNext } from '$lib/server/auth/safe-next';
 import { createSessionToken, SESSION_COOKIE, SESSION_TTL_SECONDS } from '$lib/server/auth/session';
 import { fail, redirect } from '@sveltejs/kit';
 import type { Actions } from './$types';
@@ -16,6 +17,8 @@ export const actions: Actions = {
 		const user = await locals.app.users.authenticate(username, password);
 		if (!user) return fail(400, { error: 'Invalid username or password', username });
 
+		locals.app.loginLimiter.reset(username.toLowerCase());
+
 		const token = createSessionToken(
 			{ uid: user.id, sv: user.sessionVersion },
 			locals.app.config.sessionSecret
@@ -28,7 +31,6 @@ export const actions: Actions = {
 			maxAge: SESSION_TTL_SECONDS
 		});
 
-		const next = url.searchParams.get('next');
-		redirect(303, next && next.startsWith('/') && !next.startsWith('//') ? next : '/');
+		redirect(303, safeNext(url.searchParams.get('next')));
 	}
 };

src/routes/logout/+server.ts

@@ -1,7 +1,8 @@
 import { SESSION_COOKIE } from '$lib/server/auth/session';
-import { redirect, type RequestHandler } from '@sveltejs/kit';
+import { error, redirect, type RequestHandler } from '@sveltejs/kit';
 
-export const POST: RequestHandler = ({ cookies }) => {
+export const POST: RequestHandler = ({ cookies, request, url }) => {
+	if (request.headers.get('origin') !== url.origin) error(403, 'Forbidden');
 	cookies.delete(SESSION_COOKIE, { path: '/' });
 	redirect(303, '/login');
 };

tests/unit/auth/auth.test.ts

@@ -66,6 +66,19 @@ describe('RateLimiter', () => {
 		expect(rl.allow('bob')).toBe(true);
 	});
 
+	it('reset() clears a key so it is immediately allowed again', () => {
+		let now = 0;
+		const rl = new RateLimiter(5, 60_000, () => now);
+		expect(rl.allow('bob')).toBe(true);
+		expect(rl.allow('bob')).toBe(true);
+		expect(rl.allow('bob')).toBe(true);
+		expect(rl.allow('bob')).toBe(true);
+		expect(rl.allow('bob')).toBe(true);
+		expect(rl.allow('bob')).toBe(false);
+		rl.reset('bob');
+		expect(rl.allow('bob')).toBe(true);
+	});
+
 	it('evicts stale keys once the tracked-key cap is exceeded', () => {
 		let now = 0;
 		const rl = new RateLimiter(5, 1_000, () => now);