/**
 * Validates a `next` redirect target so login can send the user back
 * to where they came from without opening a redirect to an external
 * site (e.g. `?next=https://evil.example`). Only same-origin,
 * root-relative paths are allowed.
 */
export function isSafeNextPath(path: string | null | undefined): path is string {
  return !!path && path.startsWith("/") && !path.startsWith("//");
}