redirect to desired page after authenticating

internal/site/auth.go

@@ -86,7 +86,8 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 	return func(r *http.Request) (response.Response, error) {
 		ck, err := r.Cookie("access_token")
 		if err != nil {
-			return response.TemporaryRedirect("/"), nil
+			return response.TemporaryRedirect("/").
+				JSON("no access_token cookie provided"), nil
 		}
 
 		ctx := r.Context()
@@ -96,7 +97,12 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 		claims, expiration, err := s.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
 		if err != nil {
 			if errors.Is(err, consts.ErrNotFound) {
-				return response.TemporaryRedirect("/"), nil
+				u, err := s.newLoginURL(ctx, r.URL.String())
+				if err != nil {
+					return nil, response.Errorf("failed to generate login url: %w", err)
+				}
+
+				return response.TemporaryRedirect(u), nil
 			}
 
 			return nil, response.Errorf("failed to authenticate: %w", err)
@@ -104,10 +110,6 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 
 		now := time.Now()
 
-		if expiration.Before(now) {
-			return response.TemporaryRedirect("/").Cookie(getExpiredCookie("access_token")), nil
-		}
-
 		// refresh tokens, when the access token is "old enough"
 
 		// id token lifetime is 48 hours, allowing a person to use the app everyday comfortably, with wiggle room, without having to log in.