Harden getSiteOrigin to use request headers (x-forwarded-host/host) and safe production fallback; remove duplicate getOrigin helpers in routes to prevent localhost:3003 redirect_uri after Google login

app/api/auth/callback/google/route.ts

@@ -9,6 +9,7 @@ import {
   fetchGoogleUserFromCode,
   isGoogleOAuthConfigured,
   verifyOAuthState,
+  getSiteOrigin,
 } from '@/infrastructure/auth/google-oauth';
 import {
   getOAuthReturnCookieName,
@@ -20,7 +21,7 @@ export const dynamic = 'force-dynamic';
 const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
 
 function redirectToLogin(error: string, returnTo?: string, req?: Request) {
-  const loginUrl = new URL('/login', getOrigin(req));
+  const loginUrl = new URL('/login', getSiteOrigin(req));
   loginUrl.searchParams.set('tab', 'customer');
   loginUrl.searchParams.set('error', error);
   if (returnTo && returnTo !== '/account') {
@@ -29,19 +30,6 @@ function redirectToLogin(error: string, returnTo?: string, req?: Request) {
   return NextResponse.redirect(loginUrl);
 }
 
-function getOrigin(req?: Request): string {
-  if (req) {
-    try {
-      const url = new URL(req.url);
-      if (process.env.NODE_ENV === 'production' && url.protocol === 'http:') {
-        url.protocol = 'https:';
-      }
-      return url.origin;
-    } catch {}
-  }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
-}
-
 export async function GET(request: Request) {
   if (!isGoogleOAuthConfigured()) {
     return redirectToLogin('google_not_configured', undefined, request);
@@ -82,7 +70,7 @@ export async function GET(request: Request) {
     getCustomerSessionCookieOptions(),
   );
 
-  const response = NextResponse.redirect(new URL(returnTo, getOrigin(request)));
+  const response = NextResponse.redirect(new URL(returnTo, getSiteOrigin(request)));
   response.headers.set('Cache-Control', 'no-store');
   return response;
 }