Bugfix Issue 1554 Login Success Fallback 404

Issue 1554 — auth/login.html: success fallback redirects to 404 instead of root index

Issue: #1554 Branch: fix/issue-1554-login-fallback Status: VERIFIED-FIXED

Symptom

Successful login on the modern screen (http://localhost:8082/gui/templates/auth/login.html) with no destination query param landed on a 404 at /gui/templates/auth/index.php?caller=login instead of the root app /index.php?caller=login. Every destination-less login hit the 404.

Repro steps

1. Open http://localhost:8082/gui/templates/auth/login.html (unauthenticated).
2. Enter valid credentials (admin/admin), click SIGN IN.
3. Observe navigation to http://localhost:8082/gui/templates/auth/index.php?caller=login → "404 Not Found".

Root cause

gui/templates/auth/login.html:228 used a relative URL as the no-destination fallback: window.location.href = 'index.php?caller=login';. Served at /gui/templates/auth/login.html, the browser resolves it under /gui/templates/auth/ → 404.

Backend is not involved: api/auth/index.php:214 feeds safeDestination($body['destination'] ?? ''), which returns '' for empty input (api/auth/index.php:59-61) and echoes 'destination' => '' (:244). The guard only ever accepts root-relative paths, so it could not produce that relative target.

The bug was masked on the /login.php entry point (login.php:383 serves the same file via readfile(), base /), which is exactly why the fix must be root-absolute so both contexts work. Introduced in commit 6e193c574.

Fix (one line)

-          window.location.href = 'index.php?caller=login';
+          window.location.href = '/index.php?caller=login';

Root-absolute matches the screen's existing URL convention (/api/..., /gui/...) and the sibling auth pages (commit b895957f5, Refs #1338). No backend change, no i18n change, safeDestination() untouched.

Verification

Regression suite Regression — Issue #1554 in tmp/TLU_Test_Cases.md (6 cases, executed live in headless Chrome): no-destination login reaches the full app shell; valid destination still followed; hostile javascript: destination still sanitized; wrong password shows error without redirect; /login.php readfile entry unaffected; events table shows only log_level=16 AUDIT rows (zero WARNING/error). 6/6 PASS.

Files changed

• gui/templates/auth/login.html (+1/-1)
• docs/screenshots/issue-1554-login-prefix-404.png, ...-login-postfix-landing.png
• tmp/TLU_Test_Cases.md (suite Regression — Issue #1554)
• CHANGELOG (1 line, Refs #1554)