Harden getSiteOrigin to use request headers (x-forwarded-host/host) and safe production fallback; remove duplicate getOrigin helpers in routes to prevent localhost:3003 redirect_uri after Google login

infrastructure/auth/google-oauth.ts

@@ -9,22 +9,23 @@ export function isGoogleOAuthConfigured(): boolean {
 }
 
 export function getSiteOrigin(req?: Request): string {
+  const configured = process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
   if (req) {
     try {
       const h = req.headers;
-      const host = h.get('x-forwarded-host') || h.get('host');
-      let proto = h.get('x-forwarded-proto') || 'https';
-      if (proto.includes(',')) proto = proto.split(',')[0].trim();
+      let host = h.get('x-forwarded-host') || h.get('host');
       if (host) {
-        // ensure https in prod
-        if (process.env.NODE_ENV === 'production' && proto === 'http') {
-          proto = 'https';
+        host = host.split(':')[0]; // strip port
+        // Only use www variant if explicitly requested; otherwise always canonical production domain
+        // This prevents localhost, IP, or internal ports from leaking into redirect_uri
+        if (host === 'www.shahikitchen.se') {
+          return 'https://www.shahikitchen.se';
         }
-        return `${proto}://${host}`;
+        return configured;
       }
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
+  return configured;
 }
 
 export function getGoogleRedirectUri(req?: Request): string {