fix(callback): preserve session redirect url before clearing auth session

[cgarnier]

Summary

Fixes #159.
Fixes #149.

In callbackEventHandler (src/runtime/server/handler/callback.ts), session.clear() was called before reading session.data.callbackRedirectUrl, so the value passed to resolveCallbackRedirectUrl was always undefined. As a result, users were always redirected to / after sign-in, even when the global middleware had stored the original target path in the session via ?callbackRedirectUrl=....

Fix

Capture session.data.callbackRedirectUrl into a local variable before clearing the session, then pass that local variable to resolveCallbackRedirectUrl. This matches the original intent of the helper and restores the expected behavior of the existing middleware-callback-redirect E2E flow.

+    const sessionCallbackRedirectUrl = session.data.callbackRedirectUrl
     await session.clear()
     deleteCookie(event, 'oidc')
     return onSuccess(event, {
       user,
       callbackRedirectUrl: resolveCallbackRedirectUrl({
         configuredCallbackRedirectUrl: config.callbackRedirectUrl,
         hasConfiguredCallbackRedirectUrl,
-        sessionCallbackRedirectUrl: session.data.callbackRedirectUrl,
+        sessionCallbackRedirectUrl,
       }),
     })

Tests

• Existing unit tests on resolveCallbackRedirectUrl (test/unit/utils/redirect.test.ts) still pass.
• pnpm test:unit — 9 files, 121 tests passing.
• pnpm typecheck — clean.
• pnpm lint — no new errors/warnings introduced by this change.

I did not add a new test: a unit test on resolveCallbackRedirectUrl would not have caught this regression (the helper itself was already correct). A meaningful regression test would require either a heavily mocked handler test or a full E2E provider flow; happy to add one if you have a preferred approach.

[jreina]

@itpropro any chance we could get this in? I'm currently patching around this behavior