fix(auth): resend-invite returns 400 behind a reverse proxy

[KubaBir]

Problem

POST /api/auth/users/resend-invite answers 400 {"error":"Invalid request origin"} on any deployment behind a reverse proxy in production. Creating a user still sends the invite email. Only the "Resend invite" button breaks. We hit this on Edube prod (Cloud Run, APP_URL=https://edube.me) and locally under Conductor, and carried a patch-package workaround until now. Present in 0.6.7 and 0.7.0.

Log line from prod:

Origin check rejected string input
requestUrl=https://localhost:3000/api/auth/users/resend-invite
allowedOrigins=['https://edube.me']

Cause

The route passed req.url to getSecurityEmailBaseUrl. Every other caller (reset.ts, requestRedirect.ts, customer_accounts/api/signup.ts, onboarding) passes req.

The origin check in @open-mercato/shared/lib/url can read two things. Given a Request it also reads Host, X-Forwarded-Host and X-Forwarded-Proto, finds the public origin there, and then tolerates a loopback URL origin. Given a string it only has the URL origin.

Behind a proxy the URL origin is never the public host. Next.js builds a route handler's request URL from its own listen hostname and port (next-server.js, ${protocol}://${this.fetchHostname}:${this.port}${req.url}), so under next start it is https://localhost:3000/.... With NODE_ENV=production and a non-loopback APP_URL, no exemption applies and the route maps the throw to 400.

Fix

One word in packages/core/src/modules/auth/api/users/resend-invite/route.ts:

-    base = getSecurityEmailBaseUrl(req.url)
+    base = getSecurityEmailBaseUrl(req)

Interface change (review follow-up)

The helper took Request | string | undefined. A string can never satisfy the check behind a proxy, so the overload existed only to be misused. The second commit narrows getSecurityEmailBaseUrl, toSecurityEmailUrl and assertAllowedAppOrigin to Request | undefined and drops the string branches. Passing a string is now a compile error. Callers with no request at all (the CLI user command, the onboarding ready email) still pass nothing.

These helpers are not in the BACKWARD_COMPATIBILITY.md signature table. A third-party caller passing a string would fail to compile after this change, and would have been getting 400s in production anyway.

Verification

Added a case to resend-invite.route.test.ts: production mode, APP_URL=https://app.example, request URL https://localhost:3000/..., headers host: app.example and x-forwarded-proto: https. It returned 400 and logged the exact warning above before the change. It passes now.

• resend-invite route suite: 14 passed, shared url suites: 54 passed, signup source check: 3 passed
• eslint on changed files: clean
• tsc on shared and onboarding: 0 errors; core shows only its pre-existing unrelated errors, none in the origin-check callers

Labels

skip-qa: no UI file touched, no schema or API change, regression test in the same PR. risk-low: one call-site change aligning with every sibling route.

🤖 Generated with Claude Code

[jtomaszewski]

Is it just here? perhaps getSecurityEmailBaseUrl shouldnt accept url as argument if that causes bugs?

[KubaBir]

Is it just here? perhaps getSecurityEmailBaseUrl shouldnt accept url as argument if that causes bugs?

It accepts either string or the full request. The other callers used the full req object so the function can get the proper url from the headers. This invocation was the only instance which passed the raw (incorrect) url string - in this case the url string was incorrect because of the proxy we have

Behind a proxy the URL origin is never the public host. Next.js builds a route handler's request URL from its own listen hostname and port (next-server.js, ${protocol}://${this.fetchHostname}:${this.port}${req.url}), so under next start it is https://localhost:3000/.... With NODE_ENV=production and a non-loopback APP_URL, no exemption applies and the route maps the throw to 400.

[jtomaszewski]

yeah then change the interface of getSecurityEmailBaseUrl so it doesnt allow for incorrect invocation.

[KubaBir]

Done in 4ffc50c. RequestInput is now Request | undefined, the string branches are gone, and passing a string no longer compiles. The no-argument form stays for callers without a request (CLI user command, onboarding ready email). Shared and onboarding typecheck clean, url and route suites green.

[github-actions]

No description provided.