fix production issues

apps/homepage/src/components/auth/SignInForm.tsx

@@ -11,6 +11,16 @@ import { usePathname, useSearchParams } from 'next/navigation';
 import { useState } from 'react';
 import styles from './AuthForms.module.css';
 
+function resolveSafeAppRedirect(candidate: string | null | undefined, fallback: string): string {
+  const value = (candidate ?? '').trim();
+  if (!value) return fallback;
+  if (!value.startsWith('/')) return fallback;
+  if (value.startsWith('//') || value.startsWith('/\\')) return fallback;
+  if (value.includes('://')) return fallback;
+  if (/[\r\n\\]/.test(value)) return fallback;
+  return value;
+}
+
 interface Dict {
   title: string;
   subtitle: string;
@@ -120,7 +130,7 @@ export function SignInForm({
   const [step, setStep] = useState<'credentials' | 'totp'>('credentials');
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const employeeRedirect = searchParams.get('redirect') || '/dashboard';
+  const employeeRedirect = resolveSafeAppRedirect(searchParams.get('redirect'), '/dashboard');
 
   function completeLogin(data: any) {
     if (data?.admin) {

apps/homepage/src/content/pricing-config.ts

@@ -1,3 +1,9 @@
+import {
+  ANNUAL_DISCOUNT_PERCENT,
+  getPublicMonthlyMajorUnits,
+  type PublicPricingPlanId,
+} from '@rentaldrivego/types';
+
 export const fleetBandIds = ['small', 'growing', 'scale', 'enterprise'] as const;
 export type FleetBandId = (typeof fleetBandIds)[number];
 
@@ -14,33 +20,28 @@ export interface PricingCommercialConfig {
   recommendedPlanByFleetBand: Record<FleetBandId, PricingPlanId>;
 }
 
+function bandPrices(planId: PublicPricingPlanId): Record<FleetBandId, number | null> {
+  const major = getPublicMonthlyMajorUnits(planId);
+  return {
+    small: major,
+    growing: major,
+    scale: major,
+    enterprise: major,
+  };
+}
+
 /**
- * This is the only file that should contain commercial pricing numbers.
- * Public prices apply only to non-custom plans. Enterprise remains custom.
+ * Public marketing prices derived from `@rentaldrivego/types` planCatalog.
+ * Do not hard-code MAD amounts here — change PLAN_PRICES in packages/types.
  */
 export const pricingCommercialConfig: PricingCommercialConfig = {
   currency: 'MAD',
-  annualDiscountPercent: 20,
+  annualDiscountPercent: ANNUAL_DISCOUNT_PERCENT,
   publicPricesApproved: true,
   monthlyPrices: {
-    launch: {
-      small: 149,
-      growing: 149,
-      scale: 149,
-      enterprise: 149,
-    },
-    growth: {
-      small: 299,
-      growing: 299,
-      scale: 299,
-      enterprise: 299,
-    },
-    enterprise: {
-      small: null,
-      growing: null,
-      scale: null,
-      enterprise: null,
-    },
+    launch: bandPrices('launch'),
+    growth: bandPrices('growth'),
+    enterprise: bandPrices('enterprise'),
   },
   recommendedPlanByFleetBand: {
     small: 'launch',