fix(auth): secure white-label invite and reset links (#1680)

app/(auth)/login/__tests__/password-reset-redirect.test.ts

@@ -0,0 +1,17 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+const SOURCE = readFileSync(
+  fileURLToPath(new URL('../login-client.tsx', import.meta.url)),
+  'utf8',
+)
+
+describe('password reset redirect wiring', () => {
+  it('routes the browser origin through the trusted app-origin resolver', () => {
+    expect(SOURCE).toContain('buildPasswordResetRedirectTo(window.location.origin)')
+    expect(SOURCE).not.toContain(
+      '`${window.location.origin}/auth/callback?next=/reset-password`',
+    )
+  })
+})

app/(auth)/login/login-client.tsx

@@ -32,6 +32,7 @@ import {
   consumeInviteCookie,
   INVITE_PROBLEM_MESSAGE_KEYS,
 } from '@/lib/auth/consume-invite-cookie'
+import { buildPasswordResetRedirectTo } from '@/lib/domains/trusted-app-origin'
 import { AuthFormError } from '@/components/auth/AuthFormError'
 import { GoogleAuthButton } from '@/components/auth/GoogleAuthButton'
 import { isGoogleAuthEnabled } from '@/lib/auth/google-oauth'
@@ -326,7 +327,7 @@ export function LoginClient({ initialMethod }: { initialMethod: LoginMethod | nu
 
     try {
       const { error } = await supabase.auth.resetPasswordForEmail(emailValue, {
-        redirectTo: `${window.location.origin}/auth/callback?next=/reset-password`,
+        redirectTo: buildPasswordResetRedirectTo(window.location.origin),
       })
 
       if (error) {