Update fallback origin in getSiteOrigin to production domain to prevent localhost in OAuth redirects

app/api/auth/callback/google/route.ts

@@ -39,7 +39,7 @@ function getOrigin(req?: Request): string {
       return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }
 
 export async function GET(request: Request) {

app/api/auth/google/route.ts

@@ -52,5 +52,5 @@ function getOrigin(req?: Request): string {
       return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }

infrastructure/auth/google-oauth.ts

@@ -11,15 +11,20 @@ export function isGoogleOAuthConfigured(): boolean {
 export function getSiteOrigin(req?: Request): string {
   if (req) {
     try {
-      const url = new URL(req.url);
+      const h = req.headers;
-      // In production behind nginx, prefer https even if internal request is http
+      const host = h.get('x-forwarded-host') || h.get('host');
-      if (process.env.NODE_ENV === 'production' && url.protocol === 'http:') {
+      let proto = h.get('x-forwarded-proto') || 'https';
-        url.protocol = 'https:';
+      if (proto.includes(',')) proto = proto.split(',')[0].trim();
+      if (host) {
+        // ensure https in prod
+        if (process.env.NODE_ENV === 'production' && proto === 'http') {
+          proto = 'https';
+        }
+        return `${proto}://${host}`;
       }
-      return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }
 
 export function getGoogleRedirectUri(req?: Request): string {