create-ailk 0.26.0 → 0.27.0

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -10,10 +10,17 @@
 //
 // Spec: docs/specs/7644-the-browser-talks-only-to-spec.md §5.1 AC-1 to AC-4.
 
-import { handleRelay, RELAY_ROUTES } from "../relay";
+import { BOT_CHECKED_ROUTES, handleRelay, RELAY_ROUTES } from "../relay";
 import { __resetRelayRateLimit, __relayRateLimitBucketCount } from "../relay";
 import { TOPOLOGY } from "../topology.generated";
 
+// #9889 — the booking bot check's verdict. `checkBotId` reads Vercel's
+// request context, which jest has none of, so every case decides it here.
+const checkBotIdMock = jest.fn();
+jest.mock("botid/server", () => ({
+  checkBotId: (...args: unknown[]) => checkBotIdMock(...args),
+}));
+
 const HUB = "https://hub.example";
 const SITE = "https://spoke.example";
 const K1 = "K1";
@@ -27,6 +34,8 @@ const ENV_KEYS = [
   "NEXT_PUBLIC_API_URL",
   "AILK_SPOKE_KEY",
   "AILK_VISITOR_FORWARD_KEY",
+  "VERCEL",
+  "AILK_BOOKING_BOT_CHECK",
 ] as const;
 const priorEnv = new Map<string, string | undefined>(
   ENV_KEYS.map((name) => [name, process.env[name]]),
@@ -885,3 +894,282 @@ describe("the per-visitor rate limit (#7707)", () => {
     );
   });
 });
+
+// The booking bot check (#9889, spec
+// docs/specs/9889-the-booking-bot-check-vercel-spec.md §5.1 AC-1 to AC-5).
+describe("the booking bot check (#9889)", () => {
+  const BOOK = "/v1/schedule/book";
+  const BOT = {
+    isHuman: false,
+    isBot: true,
+    isVerifiedBot: false,
+    bypassed: false,
+  };
+  const HUMAN = {
+    isHuman: true,
+    isBot: false,
+    isVerifiedBot: false,
+    bypassed: false,
+  };
+
+  let warnSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    checkBotIdMock.mockReset();
+    process.env.VERCEL = "1";
+    warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  describe("AC-1 — a bot verdict is refused before the hub is called", () => {
+    it.each([
+      ["a bot", BOT],
+      ["a verified bot", { ...BOT, isVerifiedBot: true }],
+    ])("%s answers 403 bot_detected", async (_label, verdict) => {
+      checkBotIdMock.mockResolvedValue(verdict);
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(403);
+      expect(await errorCode(res)).toBe("bot_detected");
+      expect(res.headers.get("cache-control")).toBe("no-store");
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+      expect(checkBotIdMock.mock.calls[0]).toEqual([]);
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+      expect(warnSpy).toHaveBeenCalledWith("[relay] bot refused", {
+        path: BOOK,
+        outcome: "bot-detected",
+      });
+    });
+  });
+
+  describe("AC-2 — a human verdict forwards exactly as with the check off", () => {
+    it("the same URL, method, body and headers, and no BotID header", async () => {
+      checkBotIdMock.mockResolvedValue(HUMAN);
+      const botIdHeaders = {
+        "x-is-human": "{}",
+        "x-path": BOOK,
+        "x-method": "POST",
+      };
+
+      delete process.env.VERCEL;
+      expect((await handleRelay(relayRequest(BOOK, { headers: botIdHeaders }))).status).toBe(201);
+      process.env.VERCEL = "1";
+      expect((await handleRelay(relayRequest(BOOK, { headers: botIdHeaders }))).status).toBe(201);
+
+      expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      const [off, on] = fetchMock.mock.calls.map(([url, init]) => ({
+        url,
+        method: init.method,
+        body: init.body,
+        headers: [...new Headers(init.headers).entries()],
+      }));
+      expect(on).toEqual(off);
+      const names = (on?.headers ?? []).map(([name]) => name);
+      for (const name of Object.keys(botIdHeaders)) {
+        expect(names).not.toContain(name);
+      }
+    });
+  });
+
+  describe("AC-3 — a check that cannot decide fails closed", () => {
+    function expectUnavailable(error: string): void {
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(errorSpy).toHaveBeenCalledTimes(1);
+      expect(errorSpy).toHaveBeenCalledWith("[relay] bot check failed", {
+        path: BOOK,
+        outcome: "bot-check-failed",
+        error,
+      });
+    }
+
+    it("a throw answers 503 and logs the error's name, never its message", async () => {
+      checkBotIdMock.mockRejectedValue(new Error("token abc"));
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(503);
+      expect(await errorCode(res)).toBe("bot_check_unavailable");
+      expectUnavailable("Error");
+      expect(JSON.stringify(errorSpy.mock.calls)).not.toContain("token abc");
+    });
+
+    it.each([
+      ["an empty verdict", {}],
+      [
+        "Vercel's error answer",
+        {
+          isHuman: undefined,
+          isBot: undefined,
+          isVerifiedBot: undefined,
+          bypassed: undefined,
+        },
+      ],
+      ["a non-boolean isBot", { ...HUMAN, isBot: "false" }],
+    ])("%s answers 503 InvalidVerdictError", async (_label, verdict) => {
+      checkBotIdMock.mockResolvedValue(verdict);
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(503);
+      expect(await errorCode(res)).toBe("bot_check_unavailable");
+      expectUnavailable("InvalidVerdictError");
+    });
+
+    describe("with fake timers", () => {
+      beforeEach(() => {
+        jest.useFakeTimers({
+          doNotFake: ["nextTick", "queueMicrotask", "setImmediate"],
+        });
+      });
+      afterEach(() => {
+        jest.useRealTimers();
+      });
+
+      it("no verdict within 5 000 ms answers 503 TimeoutError", async () => {
+        checkBotIdMock.mockReturnValue(new Promise(() => {}));
+        const pending = handleRelay(relayRequest(BOOK));
+        await jest.advanceTimersByTimeAsync(5_000);
+        const res = await pending;
+        expect(res.status).toBe(503);
+        expect(await errorCode(res)).toBe("bot_check_unavailable");
+        expectUnavailable("TimeoutError");
+      });
+
+      it("a check that settles in time leaves no timer pending", async () => {
+        checkBotIdMock.mockResolvedValue(BOT);
+        const res = await handleRelay(relayRequest(BOOK));
+        expect(res.status).toBe(403);
+        expect(jest.getTimerCount()).toBe(0);
+      });
+    });
+  });
+
+  describe("AC-4 — the switch", () => {
+    it.each([
+      ["VERCEL=1, AILK_BOOKING_BOT_CHECK=off", "1", "off"],
+      ['VERCEL=1, AILK_BOOKING_BOT_CHECK=" OFF "', "1", " OFF "],
+      ["VERCEL unset, switch unset", undefined, undefined],
+    ])("%s forwards with no BotID call", async (_label, vercel, check) => {
+      checkBotIdMock.mockResolvedValue(BOT);
+      if (vercel === undefined) delete process.env.VERCEL;
+      else process.env.VERCEL = vercel;
+      if (check === undefined) delete process.env.AILK_BOOKING_BOT_CHECK;
+      else process.env.AILK_BOOKING_BOT_CHECK = check;
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(201);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it.each(["on", "0"])(
+      "VERCEL=1, AILK_BOOKING_BOT_CHECK=%s keeps the check on",
+      async (check) => {
+        checkBotIdMock.mockResolvedValue(BOT);
+        process.env.AILK_BOOKING_BOT_CHECK = check;
+        const res = await handleRelay(relayRequest(BOOK));
+        expect(res.status).toBe(403);
+        expect(await errorCode(res)).toBe("bot_detected");
+        expect(fetchMock).not.toHaveBeenCalled();
+      },
+    );
+
+    describe("in production, off Vercel", () => {
+      const env = process.env as Record<string, string | undefined>;
+      const priorNodeEnv = env.NODE_ENV;
+      beforeEach(() => {
+        env.NODE_ENV = "production";
+        delete process.env.VERCEL;
+      });
+      afterEach(() => {
+        env.NODE_ENV = priorNodeEnv;
+      });
+
+      async function twoBookings(): Promise<void> {
+        await jest.isolateModulesAsync(async () => {
+          const fresh = await import("../relay");
+          for (let i = 0; i < 2; i++) {
+            const res = await fresh.handleRelay(relayRequest(BOOK));
+            expect(res.status).toBe(201);
+          }
+        });
+      }
+
+      it("warns once per process that the check is not running", async () => {
+        await twoBookings();
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+        expect(warnSpy).toHaveBeenCalledTimes(1);
+        expect(warnSpy).toHaveBeenCalledWith(
+          "[relay] booking bot check inactive",
+          { outcome: "not-on-vercel" },
+        );
+      });
+
+      it("with the switch off, warns nothing", async () => {
+        process.env.AILK_BOOKING_BOT_CHECK = "off";
+        await twoBookings();
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+        expect(warnSpy).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe("AC-5 — only the booking, and only after the local refusals", () => {
+    beforeEach(() => {
+      checkBotIdMock.mockResolvedValue(BOT);
+    });
+
+    it.each(ENTRIES.filter((e) => e.path !== BOOK))(
+      "$method $path forwards with no BotID call",
+      async (entry) => {
+        const res = await handleRelay(entryRequest(entry));
+        expect(res.status).toBe(201);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+      },
+    );
+
+    it("a cross-site booking answers 403 cross_site with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { headers: { "sec-fetch-site": "cross-site" } }),
+      );
+      expect(res.status).toBe(403);
+      expect(await errorCode(res)).toBe("cross_site");
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("an over-budget booking answers 429 with no BotID call", async () => {
+      const visitor = { "x-forwarded-for": "203.0.113.9" };
+      for (let i = 0; i < 8; i++) {
+        await handleRelay(relayRequest("/v1/leads/submit", { headers: visitor }));
+      }
+      const res = await handleRelay(relayRequest(BOOK, { headers: visitor }));
+      expect(res.status).toBe(429);
+      expect(await errorCode(res)).toBe("rate_limited");
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("a non-JSON booking answers 415 with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { headers: { "content-type": "text/plain" } }),
+      );
+      expect(res.status).toBe(415);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("an oversized booking answers 413 with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { body: "x".repeat(1_048_577) }),
+      );
+      expect(res.status).toBe(413);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("BOT_CHECKED_ROUTES is the booking pair, frozen, and RELAY_ROUTES' own entry", () => {
+      expect(BOT_CHECKED_ROUTES).toEqual([{ method: "POST", path: BOOK }]);
+      expect(Object.isFrozen(BOT_CHECKED_ROUTES)).toBe(true);
+      expect(BOT_CHECKED_ROUTES[0]).toBe(
+        RELAY_ROUTES.find((r) => r.method === "POST" && r.path === BOOK),
+      );
+    });
+  });
+});

package/templates/apps/web/lib/hub-session/__tests__/sign-in-gate.test.tsx

@@ -4,6 +4,10 @@
  * the one card's frame — the mark in the tile, "Sign in to <site>", the toggle
  * line to the hub's /sign-up (or the site's own prospect line when its
  * messages carry one), and the Terms + Privacy acknowledgement.
+ *
+ * #9912 D1: that toggle reaches the hub's /sign-up through the same round trip
+ * as Sign in — this site's own sign-in route with `prompt=create` and the
+ * same `next` — so completing sign-up returns the buyer here.
  */
 import { render, screen, within } from "@testing-library/react";
 import en from "../../../messages/en.json";
@@ -94,7 +98,11 @@ describe("<HubSignInGate/> (#8790 AC-1; #9662)", () => {
     );
     expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
       "href",
-      "https://hub.example/sign-up",
+      "/api/hub-session/sign-in?next=%2Faccount&prompt=create",
+    );
+    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount",
     );
     const footnote = screen.getByTestId("auth-card-footnote");
     expect(footnote).toHaveTextContent(
@@ -107,6 +115,18 @@ describe("<HubSignInGate/> (#8790 AC-1; #9662)", () => {
       within(footnote).getByRole("link", { name: "Privacy Policy" }),
     ).toHaveAttribute("href", "/privacy");
   });
+
+  it("starts Sign up with the requested path as next, the Sign in button's own URL plus prompt=create (#9912 D1, AC-1)", async () => {
+    await renderGate("/account/billing");
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount%2Fbilling&prompt=create",
+    );
+    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount%2Fbilling",
+    );
+  });
 });
 
 describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
@@ -131,7 +151,7 @@ describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
     await renderGate();
     expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
       "href",
-      "https://hub.example/sign-up",
+      "/api/hub-session/sign-in?next=%2Faccount&prompt=create",
     );
   });
 

package/templates/apps/web/lib/hub-session/sign-in-gate.tsx

@@ -17,12 +17,14 @@
  * The one card (#9662, operator 2026-10-24): the single hub action sits in
  * `AuthCard`'s frame — the site's mark in the 48px tile, "Sign in to <site>"
  * (`SITE_NAME`, the deployment's own name, never the request's), the
- * "Don't have an account? Sign up" line to the hub's `/sign-up`, and the
- * Terms + Privacy acknowledgement on this site's own policy routes. A site
- * that fills `account.gate.prospectPrompt` + `prospectLink` + `prospectHref`
- * replaces the toggle line with its own. The acknowledgement is built here
- * rather than from the `(auth)` group's builder: a spoke carries no `(auth)`
- * group (create-ailk's `SPOKE_REMOVAL_SEEDS`).
+ * "Don't have an account? Sign up" line to this site's own sign-in route with
+ * `prompt=create`, which lands on the hub's sign-up screen and returns here
+ * (#9912 D1), and the Terms + Privacy acknowledgement on this site's own
+ * policy routes. A site that fills `account.gate.prospectPrompt` +
+ * `prospectLink` + `prospectHref` replaces the toggle line with its own. The
+ * acknowledgement is built here rather than from the `(auth)` group's
+ * builder: a spoke carries no `(auth)` group (create-ailk's
+ * `SPOKE_REMOVAL_SEEDS`).
  *
  * Not configured (`hubSessionConfig()` is `null`: a client id, secret or
  * session secret missing), the card says "sign-in isn't available yet" and
@@ -60,6 +62,7 @@ export async function HubSignInGate({
   const next =
     requestHeaders.get("x-pathname") ??
     localeHref(locale, HUB_SESSION_FALLBACK_PATH);
+  const signInHref = `${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`;
   const home = localeHref(locale, "/");
   // The three prospect keys are optional extensions of the typed catalog (the
   // shipped en.json carries none — every leaf must be a non-empty string), so
@@ -78,7 +81,7 @@ export async function HubSignInGate({
       : {
           prompt: signIn("prospectPrompt"),
           linkLabel: signIn("prospectLink"),
-          href: `${config.hubOrigin}/sign-up`,
+          href: `${signInHref}&prompt=create`,
         };
 
   return (
@@ -114,7 +117,7 @@ export async function HubSignInGate({
                 // The primary action: full width at `big` (44px).
                 <Button asChild size="big" className="w-full">
                   <Link
-                    href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
+                    href={signInHref}
                     variant="bare"
                     data-testid="account-hub-sign-in"
                   >

package/templates/apps/web/lib/relay.ts

@@ -35,12 +35,20 @@
  *     and only as strong as the platform: it holds only where the site's edge
  *     overwrites `x-forwarded-for` and `x-real-ip` (Vercel does; a bare
  *     self-hosted Next server does not).
+ *   - A BOT CHECK ON THE BOOKING (#9889). `POST /v1/schedule/book` asks
+ *     Vercel BotID (`checkBotId`) for a verdict after every refusal above and
+ *     before the hub is called. Only a human verdict forwards; a bot is
+ *     `403 bot_detected`, and a check that throws, answers no boolean or
+ *     takes over 5 seconds is `503 bot_check_unavailable` — either way the
+ *     hub is never called. It runs only on Vercel (`VERCEL=1`), unless
+ *     `AILK_BOOKING_BOT_CHECK=off`.
  *
  * NO SECRET IS LOGGED. A failure logs `{ path, outcome }` and nothing else.
  */
 import { isIP } from "node:net";
 
 import { relayToApi, visitorForwardHeaders } from "@working-theory/api-client";
+import { checkBotId } from "botid/server";
 
 import { browserApiOrigin } from "./api-origin.generated";
 import { readConsentVisitorFromCookieHeader } from "./consent-visitor";
@@ -69,15 +77,92 @@ function route(method: RelayMethod, path: string): RelayRoute {
  */
 const SESSION_ROUTE = route("POST", "/v1/commerce/invoices");
 
+/** The booking pair, the one route the bot check guards (#9889 D1). */
+const BOOK_ROUTE = route("POST", "/v1/schedule/book");
+
 export const RELAY_ROUTES: readonly RelayRoute[] = Object.freeze([
   route("POST", "/v1/leads/submit"),
   route("POST", "/v1/leads/subscribe"),
   route("POST", "/v1/leads/callback"),
   route("GET", "/v1/schedule/availability"),
-  route("POST", "/v1/schedule/book"),
+  BOOK_ROUTE,
   SESSION_ROUTE,
 ]);
 
+/**
+ * The entries the bot check guards (#9889 D1, D4). The locale layout passes
+ * the same list to `BotIdClient`, so the browser protects exactly the pairs
+ * the server checks: a checked pair the client does not protect would carry
+ * no challenge header and be refused as a bot.
+ */
+export const BOT_CHECKED_ROUTES: readonly RelayRoute[] = Object.freeze([
+  BOOK_ROUTE,
+]);
+
+/** The longest the relay waits for a verdict; the library's own fetch has no bound. */
+const BOT_CHECK_TIMEOUT_MS = 5_000;
+
+/**
+ * True when the booking bot check runs (#9889 D2): on Vercel, unless
+ * `AILK_BOOKING_BOT_CHECK` is `off`. Unset, empty or any other value leaves
+ * it on, so a typo fails toward protection. Read on every call, never cached.
+ */
+export function bookingBotCheckOn(): boolean {
+  return process.env.VERCEL === "1" && !botCheckSwitchedOff();
+}
+
+function botCheckSwitchedOff(): boolean {
+  return process.env.AILK_BOOKING_BOT_CHECK?.trim().toLowerCase() === "off";
+}
+
+let warnedBotCheckInactive = false;
+
+/**
+ * Called when the check is off. Off Vercel it cannot run (D2): a production
+ * site whose switch is not `off` logs that once per process, so an owner who
+ * believes it is on can find out. It never refuses.
+ */
+function warnBotCheckInactiveOnce(): void {
+  if (warnedBotCheckInactive || process.env.NODE_ENV !== "production") return;
+  if (botCheckSwitchedOff()) return;
+  warnedBotCheckInactive = true;
+  console.warn("[relay] booking bot check inactive", {
+    outcome: "not-on-vercel",
+  });
+}
+
+function namedError(name: string): Error {
+  const err = new Error(name);
+  err.name = name;
+  return err;
+}
+
+/**
+ * BotID's verdict on this request (D1, D3): `true` for a bot, `false` for a
+ * human. Throws `TimeoutError` past `BOT_CHECK_TIMEOUT_MS` and
+ * `InvalidVerdictError` when `isBot` is not a boolean, as `checkBotId` returns
+ * for an error answer from Vercel.
+ */
+async function isBotVerdict(): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const verdict = await Promise.race([
+      checkBotId(),
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () => reject(namedError("TimeoutError")),
+          BOT_CHECK_TIMEOUT_MS,
+        );
+      }),
+    ]);
+    const isBot = (verdict as { isBot?: unknown } | undefined)?.isBot;
+    if (typeof isBot !== "boolean") throw namedError("InvalidVerdictError");
+    return isBot;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * The three lead routes (#8438 D11, D12): a visitor's banner choice is
  * linked to a Person only through these — a booking has no consent writer.
@@ -466,6 +551,36 @@ export async function handleRelay(request: Request): Promise<Response> {
     return refusal(502, "relay_unreachable", "The site could not reach its API");
   }
 
+  if (BOT_CHECKED_ROUTES.includes(entry)) {
+    if (bookingBotCheckOn()) {
+      let isBot: boolean;
+      try {
+        isBot = await isBotVerdict();
+      } catch (err) {
+        // The error's name only — never its message (#9889 D1).
+        console.error("[relay] bot check failed", {
+          path: entry.path,
+          outcome: "bot-check-failed",
+          error: err instanceof Error ? err.name : "unknown",
+        });
+        return refusal(
+          503,
+          "bot_check_unavailable",
+          "The booking check is unavailable",
+        );
+      }
+      if (isBot) {
+        console.warn("[relay] bot refused", {
+          path: entry.path,
+          outcome: "bot-detected",
+        });
+        return refusal(403, "bot_detected", "Request refused");
+      }
+    } else {
+      warnBotCheckInactiveOnce();
+    }
+  }
+
   try {
     const result = await relayToApi(
       entry.method === "GET" ? `${entry.path}${url.search}` : entry.path,

package/templates/apps/web/lib/sign-up-agreements.ts

@@ -517,8 +517,13 @@ type HookContext = Parameters<
 /**
  * A refused magic-link verify: the redirect the plugin's own
  * `redirectWithError` builds — the request's `errorCallbackURL`, else its
- * `callbackURL`, else `/`, against the base URL, with `error=<code>`. The
- * plugin's origin check has already vetted both URLs.
+ * `callbackURL`, else `/`, against the base URL, with `error=<code>`.
+ *
+ * The query value is used as the router decoded it, never decoded again
+ * (#9896): a second decode turns `/%2F%2Fevil.com` into a URL on another
+ * host, and a malformed `%` into a throw. Whatever the plugin's origin check
+ * allowed, a value that does not resolve on the base URL's origin — or does
+ * not parse — is replaced by `/`.
  */
 function verifyRefusal(
   context: NonNullable<HookContext>,
@@ -527,10 +532,16 @@ function verifyRefusal(
   const raw =
     bodyField(context.query, "errorCallbackURL") ??
     bodyField(context.query, "callbackURL");
-  const url = new URL(
-    typeof raw === "string" ? decodeURIComponent(raw) : "/",
-    context.context.baseURL,
-  );
+  const { baseURL } = context.context;
+  let url = new URL("/", baseURL);
+  if (typeof raw === "string") {
+    try {
+      const resolved = new URL(raw, baseURL);
+      if (resolved.origin === url.origin) url = resolved;
+    } catch {
+      // Unparseable: stays `/`.
+    }
+  }
   url.searchParams.set("error", code);
   return context.redirect(url.toString());
 }