Use UTF-8 safe return-to encoding and decoding across router and login

Co-Authored-By: Codex <codex@openai.com>

src/router/index.ts

@@ -12,6 +12,7 @@
 import { createRouter, createWebHistory } from "vue-router";
 import { useLoginStore } from "@/stores/login";
 import { getCookie, setCookie } from "@/utils/cookieUtil";
+import { encodeReturnTo } from "@/utils/returnToEncoding";
 import AuthContainer from "@/views/AuthContainer.vue";
 import MainContainer from "@/views/MainContainer.vue";
 import Login from "@/views/Login/LoginPage.vue";
@@ -182,7 +183,7 @@ function buildLoginRedirect(fullPath: string) {
   return {
     path: "/login",
     query: {
-      "return-to": btoa(fullPath),
+      "return-to": encodeReturnTo(fullPath),
     },
   };
 }

src/stores/login.ts

@@ -13,6 +13,7 @@ import { defineStore } from "pinia";
 import axios from "axios";
 import apiClient from "@/api/client.js";
 import apiError from "@/module/apiError.js";
+import { decodeReturnTo } from "@/utils/returnToEncoding";
 import {
   deleteCookie,
   setCookie,
@@ -73,7 +74,7 @@ export const useLoginStore = defineStore("loginStore", {
         if (this.rememberedReturnToUrl !== "") {
           let decodedUrl = "";
           try {
-            decodedUrl = atob(this.rememberedReturnToUrl);
+            decodedUrl = decodeReturnTo(this.rememberedReturnToUrl);
           } catch {
             this.$router.push("/files");
             return;

src/utils/returnToEncoding.js

@@ -0,0 +1,30 @@
+// The Lucia project.
+// Copyright 2026-2026 DSP, inc.  All rights reserved.
+// Authors:
+//   imacat.yang@dsp.im (imacat), 2026/03/08
+/** @module returnToEncoding UTF-8 safe base64 helpers for return-to paths. */
+
+/**
+ * Encodes a return-to path into UTF-8 safe base64.
+ * @param {string} returnToPath - The relative path to preserve.
+ * @returns {string} Base64-encoded UTF-8 string.
+ */
+export function encodeReturnTo(returnToPath) {
+  const bytes = new TextEncoder().encode(returnToPath);
+  let binary = "";
+  bytes.forEach((byte) => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary);
+}
+
+/**
+ * Decodes a UTF-8 safe base64 return-to payload back to a path.
+ * @param {string} encodedReturnTo - Base64 payload from query parameter.
+ * @returns {string} Decoded path string.
+ */
+export function decodeReturnTo(encodedReturnTo) {
+  const binary = atob(encodedReturnTo);
+  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}