Fix auth redirects to route users into app

Author: felmonon

src/app/api/auth/magic-link/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
-import { getSiteUrlOrThrow } from '@/lib/site-url';
 
 function getClientIP(request: NextRequest): string {
   return (
@@ -64,17 +63,11 @@ export async function POST(request: NextRequest) {
       },
     );
 
-    let siteUrl: string;
-    try {
-      siteUrl = getSiteUrlOrThrow();
-    } catch (error) {
-      console.error('[magic-link] Invalid NEXT_PUBLIC_SITE_URL:', error);
-      return NextResponse.json({ error: 'Server configuration error.' }, { status: 500 });
-    }
+    const siteUrl = request.nextUrl.origin;
 
     const { error } = await supabase.auth.signInWithOtp({
       email,
-      options: { emailRedirectTo: `${siteUrl}/auth/callback` },
+      options: { emailRedirectTo: `${siteUrl}/auth/callback?next=/app/today` },
     });
 
     if (error) {

src/app/api/auth/signup/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient as createSSRServerClient } from '@supabase/ssr';
 import { checkRateLimit, AUTH_RATE_LIMITS } from '@/lib/rate-limit';
-import { getSiteUrlOrThrow } from '@/lib/site-url';
 
 function getClientIP(request: NextRequest): string {
   return (
@@ -70,13 +69,7 @@ export async function POST(request: NextRequest) {
       },
     );
 
-    let siteUrl: string;
-    try {
-      siteUrl = getSiteUrlOrThrow();
-    } catch (error) {
-      console.error('[signup] Invalid NEXT_PUBLIC_SITE_URL:', error);
-      return NextResponse.json({ error: 'Server configuration error.' }, { status: 500 });
-    }
+    const siteUrl = request.nextUrl.origin;
 
     const { error } = await supabase.auth.signUp({
       email,

src/app/auth/callback/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { createServerClient } from '@supabase/ssr';
 import type { CookieOptions } from '@supabase/ssr';
-import { getSiteUrlOrThrow } from '@/lib/site-url';
 
 /**
  * Validate the `next` param to prevent open-redirect attacks.
@@ -29,13 +28,7 @@ function sanitizeRedirectPath(raw: string | null, origin: string): string {
 export async function GET(request: NextRequest) {
   const { searchParams } = new URL(request.url);
   const code = searchParams.get('code');
-  let siteUrl: string;
-  try {
-    siteUrl = getSiteUrlOrThrow();
-  } catch (error) {
-    console.error('[auth/callback] Invalid NEXT_PUBLIC_SITE_URL:', error);
-    return NextResponse.json({ error: 'Server configuration error.' }, { status: 500 });
-  }
+  const siteUrl = request.nextUrl.origin;
   const next = sanitizeRedirectPath(searchParams.get('next'), siteUrl);
 
   if (code) {

src/app/login/page.tsx

@@ -110,10 +110,10 @@ function LoginForm() {
   async function handleGoogleLogin() {
     setError('');
     setGoogleLoading(true);
-    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL || window.location.origin;
+    const redirectTo = new URL('/auth/callback?next=/app/today', window.location.origin).toString();
     const { error } = await supabase.auth.signInWithOAuth({
       provider: 'google',
-      options: { redirectTo: `${siteUrl}/auth/callback` },
+      options: { redirectTo },
     });
     if (error) {
       setGoogleLoading(false);

src/app/signup/page.tsx

@@ -103,10 +103,10 @@ export default function SignupPage() {
   async function handleGoogleSignup() {
     setError('');
     setGoogleLoading(true);
-    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL || window.location.origin;
+    const redirectTo = new URL('/auth/callback?next=/onboarding', window.location.origin).toString();
     const { error } = await supabase.auth.signInWithOAuth({
       provider: 'google',
-      options: { redirectTo: `${siteUrl}/auth/callback?next=/onboarding` },
+      options: { redirectTo },
     });
     if (error) {
       setGoogleLoading(false);