Implemented phase 2 for the POC prototype in the Website service.

Services/Website/Tests/Library/Cases/Internal/Extensions/ListingDisplayTests.swift

@@ -74,6 +74,30 @@ struct ListingDisplayTests {
         #expect(cents.euros == price)
     }
 
+    @Test(arguments: zip(
+        ["/listing/a?x=1", "/", "//evil.example", "https://evil.example", "/\\evil.example", "listing/a", "", "/a\nb"],
+        ["/listing/a?x=1", "/", "/", "/", "/", "/", "/", "/"]
+    ))
+    func `follows a return path only within the site`(
+        _ path: String,
+        expects safe: String
+    ) {
+        #expect(String.Route.safeReturn(path) == safe)
+    }
+
+    @Test
+    func `returns home without a return path`() {
+        #expect(String.Route.safeReturn(nil) == "/")
+    }
+
+    @Test
+    func `leads a gated action to itself signed in, and to the sign-in signed out`() {
+        let offer = String.Route.offer("a")
+
+        #expect(String.Route.gated(offer, from: "/listing/a", viewer: .init(displayName: "Mara")) == "/listing/a/offer")
+        #expect(String.Route.gated(offer, from: "/listing/a", viewer: nil) == "/sign-in?return=/listing/a")
+    }
+
     @Test
     func `returns to the gated action's path after sign-in`() {
         #expect(String.Route.signIn(returningTo: "/shop/a?keys=1&page=2") == "/sign-in?return=/shop/a%3Fkeys%3D1%26page%3D2")