Use UTF-8 safe return-to encoding and decoding across router and login

Co-Authored-By: Codex <codex@openai.com>

tests/router/routerGuard.test.js

@@ -4,6 +4,7 @@
 //   imacat.yang@dsp.im (imacat), 2026/03/06
 
 import { describe, it, expect, beforeEach } from "vitest";
+import { decodeReturnTo } from "@/utils/returnToEncoding";
 
 describe("router beforeEach guard logic", () => {
   beforeEach(() => {
@@ -70,7 +71,7 @@ describe("router beforeEach guard logic", () => {
       matched: [{ meta: { requiresAuth: true } }],
     });
     expect(result.path).toBe("/login");
-    expect(atob(result.query["return-to"])).toBe("/files");
+    expect(decodeReturnTo(result.query["return-to"])).toBe("/files");
   });
 
   it("allows requiresAuth route when refresh token can refresh session", () => {
@@ -100,7 +101,7 @@ describe("router beforeEach guard logic", () => {
       { refreshSucceeds: false },
     );
     expect(result.path).toBe("/login");
-    expect(atob(result.query["return-to"])).toBe(
+    expect(decodeReturnTo(result.query["return-to"])).toBe(
       "/discover/log/1/map?view=summary#node-2",
     );
   });

tests/unit/utils/returnToEncoding.test.js

@@ -0,0 +1,21 @@
+// The Lucia project.
+// Copyright 2026-2026 DSP, inc.  All rights reserved.
+// Authors:
+//   imacat.yang@dsp.im (imacat), 2026/03/08
+
+import { describe, expect, it } from "vitest";
+import { encodeReturnTo, decodeReturnTo } from "@/utils/returnToEncoding";
+
+describe("returnToEncoding", () => {
+  it("round-trips ASCII paths", () => {
+    const original = "/discover/log/1/map?view=summary#node-2";
+    const encoded = encodeReturnTo(original);
+    expect(decodeReturnTo(encoded)).toBe(original);
+  });
+
+  it("round-trips Unicode paths without throwing", () => {
+    const original = "/files?keyword=流程圖#節點";
+    const encoded = encodeReturnTo(original);
+    expect(decodeReturnTo(encoded)).toBe(original);
+  });
+});