# [CRUCIBLE-SEED]
# category: open_redirect
# severity: high
# language: ruby
# expected: redirect_to with 'next' or 'return_to' parameter — open redirect after login

class AuthController < ApplicationController
  def callback
    next_url = params[:next] || params[:return_to] || dashboard_path
    redirect_to next_url
  end

  def logout
    sign_out current_user
    redirect_to params[:redirect]
  end

  def sso_redirect
    target = request.params['RelayState'] || root_url
    redirect_to target, allow_other_host: true
  end
end