fix: prevent login JS crash when returnUrl is empty

Replace eval-built form submit with tsaLogin.submitForm so a missing returnUrl no longer produces invalid JavaScript.

Co-authored-by: Cursor <cursoragent@cursor.com>

WebApp/Components/App.razor

@@ -26,6 +26,7 @@
     <script src="_content/PSC.Blazor.Components.MarkdownEditor/js/easymde.min.js"></script>
     <script src="_content/PSC.Blazor.Components.MarkdownEditor/js/markdownEditor.js"></script>
     <script src="js/markdownTablePaste.js"></script>
+    <script src="js/login.js"></script>
 </body>
 
 </html>

WebApp/Components/Features/Authentication/Login.razor

@@ -134,7 +134,7 @@
         if (e.Key == "Enter")
         {
             // Blur the active element to ensure MudTextField bindings update
-            await JS.InvokeVoidAsync("eval", "document.activeElement.blur()");
+            await JS.InvokeVoidAsync("tsaLogin.blurActiveElement");
 
             // Small delay to allow bindings to process
             await Task.Delay(50);
@@ -146,14 +146,11 @@
 
     private async Task HandleFormSubmit()
     {
-        // Update hidden inputs with current model values, then submit the form
+        await JS.InvokeVoidAsync(
-        var returnUrlValue = string.IsNullOrEmpty(_returnUrl) ? "" : System.Text.Json.JsonSerializer.Serialize(_returnUrl);
+            "tsaLogin.submitForm",
-        await JS.InvokeVoidAsync("eval", $@"
+            _loginModel.Email ?? string.Empty,
-            document.getElementById('emailInput').value = {System.Text.Json.JsonSerializer.Serialize(_loginModel.Email)};
+            _loginModel.Password ?? string.Empty,
-            document.getElementById('passwordInput').value = {System.Text.Json.JsonSerializer.Serialize(_loginModel.Password)};
+            _loginModel.RememberMe,
-            document.getElementById('rememberMeInput').value = '{_loginModel.RememberMe.ToString().ToLower()}';
+            _returnUrl ?? string.Empty);
-            document.getElementById('returnUrlInput').value = {returnUrlValue};
-            document.getElementById('loginForm').submit();
-        ");
     }
 }

WebApp/wwwroot/js/login.js

@@ -0,0 +1,30 @@
+window.tsaLogin = {
+    /**
+     * Copies Blazor-bound credentials into the classic form fields and submits.
+     * Avoids building JS via string eval (empty returnUrl previously produced ".value = ;").
+     */
+    submitForm: function (email, password, rememberMe, returnUrl) {
+        var emailInput = document.getElementById('emailInput');
+        var passwordInput = document.getElementById('passwordInput');
+        var rememberMeInput = document.getElementById('rememberMeInput');
+        var returnUrlInput = document.getElementById('returnUrlInput');
+        var form = document.getElementById('loginForm');
+
+        if (!emailInput || !passwordInput || !rememberMeInput || !returnUrlInput || !form) {
+            console.error('tsaLogin.submitForm: login form elements not found');
+            return;
+        }
+
+        emailInput.value = email ?? '';
+        passwordInput.value = password ?? '';
+        rememberMeInput.value = rememberMe ? 'true' : 'false';
+        returnUrlInput.value = returnUrl ?? '';
+        form.submit();
+    },
+
+    blurActiveElement: function () {
+        if (document.activeElement && typeof document.activeElement.blur === 'function') {
+            document.activeElement.blur();
+        }
+    }
+};