fix: don't crash the server on URI paths with invalid percent-encoding

Scanner requests like /chat/..%c0%af..%c0%afetc/passwd or
/chat/WEB-INF/web.xml%C0%80.jsp killed prod pods: SvelteKit calls the
handle hook even when the pathname fails to decode (it only produces the
400 Malformed URI error inside resolve()), so the OAuth login branch ran
first and its thrown redirect() ended up as an unhandled promise
rejection, which terminates the Node process.

Two changes:
- handle hook rejects paths with invalid percent-encoding with a plain
  400 before any auth/OAuth logic
- triggerOauthFlow returns a real 302 Response instead of throwing a
  Redirect, so it can never surface as an unhandled rejection

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: arekborucki

src/lib/server/auth.ts

@@ -12,7 +12,7 @@ import { config } from "$lib/server/config";
 import { sha256 } from "$lib/utils/sha256";
 import { z } from "zod";
 import { dev } from "$app/environment";
-import { redirect, type Cookies } from "@sveltejs/kit";
+import { type Cookies } from "@sveltejs/kit";
 import { collections } from "$lib/server/database";
 import JSON5 from "json5";
 import { logger } from "$lib/server/logger";
@@ -580,5 +580,9 @@ export async function triggerOauthFlow({ url, locals, cookies }: RequestEvent):
 		{ sessionId: locals.sessionId, next, url, cookies }
 	);
 
-	throw redirect(302, authorizationUrl);
+	// Return a real 302 response instead of `throw redirect(...)`: this
+	// function is called from the handle hook, where a thrown Redirect that
+	// crosses an unawaited promise boundary becomes an unhandled rejection
+	// and kills the Node process (observed in prod with scanner requests).
+	return new Response(null, { status: 302, headers: { location: authorizationUrl } });
 }

src/lib/server/hooks/handle.ts

@@ -59,6 +59,16 @@ export async function handleRequest({ event, resolve }: HandleInput): Promise<Re
 				});
 			}
 
+			// Reject URI paths with invalid percent-encoding (e.g. overlong UTF-8
+			// like %c0%af used by path-traversal scanners) before any further
+			// processing. SvelteKit only turns these into a 400 inside resolve();
+			// the OAuth redirect logic below runs earlier and must not see them.
+			try {
+				decodeURIComponent(event.url.pathname);
+			} catch {
+				return errorResponse(400, "Malformed URI");
+			}
+
 			if (event.route.id === "/admin" || event.route.id?.startsWith("/admin/")) {
 				const ADMIN_SECRET = config.ADMIN_API_SECRET || config.PARQUET_EXPORT_SECRET;