Harden admin authentication behind trusted proxy

app/admin_ui/pages/opportunities.py

@@ -3109,13 +3109,17 @@ async def fiscal_suggestion_accept_action(suggestion_id: str, request: Request):
 
 @router.post("/fiscal-suggestions/{suggestion_id}/reject")
 async def fiscal_suggestion_reject_action(suggestion_id: str, request: Request):
+    from app.admin_auth import safe_local_redirect
     try:
         from app.fiscal_enrichment_service import reject_fiscal_suggestion
         reject_fiscal_suggestion(suggestion_id, actor="operator_ui")
     except Exception as exc:
         return PlainTextResponse(f"Erro ao rejeitar sugestão fiscal: {exc}", status_code=500)
-    referer = request.headers.get("referer") or "/opportunities"
-    return RedirectResponse(referer, status_code=303)
+    redirect_target = safe_local_redirect(
+        request.headers.get("referer"),
+        fallback="/opportunities",
+    )
+    return RedirectResponse(redirect_target, status_code=303)
 
 
 
@@ -3422,4 +3426,3 @@ async def opportunity_odoo_link_candidate_action(opportunity_id: str, item_id: s
         return PlainTextResponse(f"Erro ao associar venda Odoo: {exc}", status_code=500)
     return RedirectResponse(url=f"/opportunities/{opportunity_id}?notice=Venda%20Odoo%20associada", status_code=303)
 
-