Harden authentication, tenant isolation and security boundaries

src/app/login/actions.ts

@@ -3,6 +3,7 @@
 import { AuthError } from "next-auth";
 import { z } from "zod";
 
+import { safeCallbackUrl } from "@/lib/safe-redirect";
 import { signIn } from "@/auth";
 
 // =====================================================================
@@ -17,7 +18,7 @@ import { signIn } from "@/auth";
 
 const loginSchema = z.object({
   email: z.string().email("Bitte eine gültige E-Mail-Adresse angeben.").toLowerCase().trim(),
-  password: z.string().min(1, "Passwort fehlt."),
+  password: z.string().min(1, "Passwort fehlt.").max(72),
   callbackUrl: z.string().optional(),
 });
 
@@ -29,12 +30,6 @@ export type LoginState = {
   };
 };
 
-function safeCallbackUrl(value: string | undefined) {
-  if (!value) return "/dashboard";
-  if (!value.startsWith("/") || value.startsWith("//")) return "/dashboard";
-  return value;
-}
-
 export async function loginAction(
   _prev: LoginState,
   formData: FormData,