From 2a489c6760852e135812062617d67ad4776db1a1 Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sat, 15 Nov 2025 09:26:26 -0800
Subject: Fix cross-domain login

---
 roseh.moe.go | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'roseh.moe.go')

diff --git a/roseh.moe.go b/roseh.moe.go
index 2576627..1f9a9f2 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -447,14 +447,17 @@ var (
 )
 
 type loginTemplateArgs struct {
-	SelfURL  string
 	Redirect string
 	Error    bool
 }
 
-func executeLoginTemplate(w io.Writer, redirect string) {
+func redirectLogin(w http.ResponseWriter, r *http.Request, redirect string) {
 	redirect += base64.RawURLEncoding.EncodeToString(mac([]byte(redirect)))
-	if err := loginTemplate.Execute(w, loginTemplateArgs{SelfURL: *selfURL, Redirect: redirect}); err != nil {
+	http.Redirect(w, r, *selfURL+"/login?redirect="+url.QueryEscape(redirect), http.StatusFound)
+}
+
+func serveLogin(w http.ResponseWriter, r *http.Request) {
+	if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: r.FormValue("redirect")}); err != nil {
 		log.Printf("Warning: login: %s", err)
 	}
 }
@@ -509,7 +512,7 @@ type notepadTemplateArgs struct {
 
 func notepad(w http.ResponseWriter, r *http.Request) {
 	if !cookieAuth(w, r) {
-		executeLoginTemplate(w, "/notepad")
+		redirectLogin(w, r, "/notepad")
 		return
 	}
 	notepadContentsMu.Lock()
@@ -586,7 +589,7 @@ type jellyfinReverseProxy struct {
 
 func (p *jellyfinReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if !cookieAuth(w, r) {
-		executeLoginTemplate(w, "https://cinema.rose.moe")
+		redirectLogin(w, r, "https://cinema.rose.moe")
 		return
 	}
 	p.proxy.ServeHTTP(w, r)
@@ -605,6 +608,7 @@ func main() {
 	http.HandleFunc("POST /wormhole/{hole}/upload", wormholeSend)
 	http.HandleFunc("GET /wormhole/{hole}", wormholeRecv)
 	http.HandleFunc("GET /wormhole/{hole}/qr.png", wormholeQR)
+	http.HandleFunc("GET /login", serveLogin)
 	http.HandleFunc("POST /login", login)
 	http.HandleFunc("GET /notepad", notepad)
 	http.HandleFunc("POST /notepad", autosave)
-- 
cgit v1.3.1