From a3ce59f2a85d9e00fad82e8e51b78f0d48ab458c Mon Sep 17 00:00:00 2001 From: weeihan Date: Fri, 17 Jul 2026 19:03:58 +0800 Subject: [PATCH] fix(auth): return 503 when NEXT_PUBLIC_APP_URL unset for invite redirectTo Prevent invite emails from falling back to localhost when NEXT_PUBLIC_APP_URL is unset in production. Now explicitly checks and rejects with 503. Co-Authored-By: Claude Sonnet 4.6 --- app/api/admin/users/route.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/app/api/admin/users/route.ts b/app/api/admin/users/route.ts index e1b5d92..a8c0b2e 100644 --- a/app/api/admin/users/route.ts +++ b/app/api/admin/users/route.ts @@ -60,7 +60,13 @@ export async function POST(request: NextRequest) { ) newUserId = created.user.id } else { - const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? 'http://localhost:3000' + const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '') + if (!appUrl) { + return NextResponse.json( + { error: 'Invite unavailable: NEXT_PUBLIC_APP_URL not configured' }, + { status: 503 }, + ) + } const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, { data: { full_name: body.name ?? '' }, redirectTo: `${appUrl}/api/auth/callback`,