Use Django login redirect encoding at the optional agent boundary

archivebox/opencode/views.py

@@ -2,8 +2,8 @@
 
 import logging
 
+from django.contrib.auth.views import redirect_to_login
 from django.http import Http404, HttpResponse, HttpResponseForbidden, StreamingHttpResponse
-from django.shortcuts import redirect
 from django.template import engines
 from django.views.decorators.csrf import csrf_exempt
 
@@ -21,7 +21,7 @@ def _dispatch(request, path=None):
         if not config.get("OPENCODE_ENABLED", False):
             raise Http404
         if not request.user.is_authenticated:
-            return redirect(f"/admin/login/?next={request.get_full_path()}")
+            return redirect_to_login(request.get_full_path(), login_url="/admin/login/")
         if not request.user.is_active or not request.user.is_superuser:
             return HttpResponseForbidden("Agent access requires a superuser account.")
 

archivebox/tests/test_opencode_agent.py

@@ -5,7 +5,7 @@ import socket
 from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
 from types import SimpleNamespace
-from urllib.parse import quote
+from urllib.parse import parse_qs, quote, urlsplit
 
 import pytest
 import requests
@@ -143,6 +143,11 @@ def test_opencode_agent_requires_superuser_when_enabled(client, db, django_user_
     assert response.status_code == 302
     assert "/admin/login/" in response.headers["Location"]
 
+    next_path = "/admin/agent?x=1&next=https://example.com"
+    response = client.get(next_path, HTTP_HOST=ADMIN_TEST_HOST)
+    assert response.status_code == 302
+    assert parse_qs(urlsplit(response.headers["Location"]).query) == {"next": [next_path]}
+
     user = django_user_model.objects.create_user(username="regular", password="testpassword")
     client.force_login(user)
     response = client.get("/admin/agent", HTTP_HOST=ADMIN_TEST_HOST)