feat: logical return_to redirects post user action (#121)

[trixy-the-ai-bot]

Summary

Closes #121

• safe_return_to helper added to ApplicationController — validates that return_to URLs are local paths only (rejects any URL with a host component), preventing open redirect attacks
• PaymentsController#create and InvoicesController#create now redirect to params[:return_to] on success, falling back to their previous defaults (payments_path and invoice_path(@invoice) respectively)
• Hidden return_to field added to payment and invoice forms so the param survives the POST request
• Action links updated in leases#show, payments#index, and invoices#index to pass return_to: request.fullpath — Renew and New Lease links are intentionally left unchanged (natural redirect exceptions)
• ‹ back button added before the page title on leases, properties, tenants, and owners show pages as an escape hatch for natural redirect flows

Test plan

• POST payments#create with return_to: lease_path → redirects to lease
• POST payments#create without return_to → redirects to payments_path (unchanged default)
• POST invoices#create with return_to: lease_path → redirects to lease
• POST invoices#create without return_to → redirects to invoice_path (unchanged default)
• POST with return_to: "http://evil.com" → redirects to fallback, not external URL
• CI passes all existing specs

🤖 Generated with Claude Code

[trixy-the-ai-bot]

CI failures addressed.

Fixed five RuboCop violations across application_controller.rb and invoices_controller.rb. The main refactor extracted the respond_to block from create into a private respond_to_create method, resolving both the method length and ABC size violations. Three smaller fixes addressed a missing blank line after a guard clause, a long line via a local variable extraction, and an HTTP status symbol rename from :unprocessable_entity to :unprocessable_content.

[TMaYaD]

A JS based < button to query browser history to find the last natural position might be a better implementation

[trixy-the-ai-bot]

CI failures addressed.

The respond_to_create method exceeded Rubocop's line count (11 vs max 10) and ABC size (19.47 vs max 17) limits. The fix inlined a redirect_path local variable and extracted the failure-handling branch into a new private method respond_to_create_failure. The parent method is now 8 lines with a lower ABC score, and the extracted helper is a simple 3-line method.

[trixy-the-ai-bot]

Review comments addressed.

A new Stimulus controller (back_controller.js) was added to handle browser back navigation using history.back(), replacing the Rails link_to :back pattern in the 4 show views (leases, owners, properties, tenants). This switch from Referer-based navigation to browser history stack is more reliable since the Referer header can be absent or stripped by privacy settings.

[trixy-the-ai-bot]

CI failures addressed.

The lint failure was a Layout/LineLength violation in invoices_controller.rb where a redirect_to call exceeded the 120-character limit. The fix split the redirect_to and its notice: argument across two lines to comply with the limit, then pushed the change.

[TMaYaD]

By history I meant go back in history until you hit a navigational check point. Not just the previous, which might be a form.

[trixy-the-ai-bot]

CI failures addressed.

Fixed a Rubocop violation in invoices_controller.rb:55-56 where a multi-line format.html block incorrectly used {...} syntax. Converting it to do...end with proper indentation resolved three offenses: Style/BlockDelimiters, Layout/MultilineBlockLayout, and Layout/BlockEndNewline. The fix was pushed.

[trixy-the-ai-bot]

Review comments addressed.

A new history_tracker_controller.js was added to the app layout to track navigation history in sessionStorage, recording only "checkpoint" pages (skipping /new and /edit URLs). The existing back_controller.js was updated to use this stack instead of history.back(), walking backwards to find the last non-current checkpoint page. This ensures the back button always navigates to a natural landing point (index or show page) rather than a form, even after a multi-step create/update flow.

[trixy-the-ai-bot]

CI failures addressed.

The fix refactored respond_to_create by extracting the safe_return_to(...) call into a local variable url, which allowed the multi-line format.html do...end block to be collapsed into a single-line format.html { }. This reduced the method from 11 lines to 9, bringing it within the 10-line limit.

[TMaYaD]

param and hidden field based return to is no longer needed.

[trixy-the-ai-bot]

Failed to address review comments: Agent exited with code 1

[trixy-the-ai-bot]

Review comments addressed.

The safe_return_to helper and all associated return_to redirect logic was removed from the app. Controllers now redirect directly to fixed paths (invoice_path / payments_path) instead of dynamically following a return_to param, and views no longer pass or store that param in forms or links. Specs were updated to drop the return_to-specific test cases while keeping coverage of the default redirect behavior.

[trixy-the-ai-bot]

CI failures addressed.

Two RuboCop layout violations were fixed: a trailing blank line inside the class body in application_controller.rb, and a trailing blank line inside a context block in payments_spec.rb. Both violations were of the Layout/EmptyLines* type.