fix: use public origins for SSO redirects

packages/helpers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/helpers",
-  "version": "0.2.70",
+  "version": "0.2.71",
   "private": true,
   "type": "module",
   "description": "Safe convenience helpers for WrNexus request contexts and common application flows.",

packages/helpers/src/index.ts

@@ -6,6 +6,7 @@
  */
 
 import type { Context } from "@wrnexus/core";
+import { currentAppOrigin } from "./workspace.ts";
 
 export type RequestContext = Pick<Context, "req" | "url">;
 
@@ -127,7 +128,7 @@ export function redirectToLogin(
   loginUrl: string | URL,
   options: LoginRedirectOptions = {},
 ): Response {
-  const target = new URL(loginUrl, ctx.url.origin);
+  const target = new URL(loginUrl, `${currentAppOrigin() ?? ctx.url.origin}/`);
   if (target.protocol !== "http:" && target.protocol !== "https:") {
     throw new TypeError("Login URL must use http or https");
   }

packages/helpers/test/helpers.test.ts

@@ -93,6 +93,29 @@ test("creates a safe login redirect with an encoded returnTo URL", () => {
   );
 });
 
+test("relative login redirects use the configured public app origin", () => {
+  const previous = process.env.WRNEXUS_APP_ORIGIN;
+  process.env.WRNEXUS_APP_ORIGIN = "https://sso.example.test";
+  try {
+    const ctx = context("http://127.0.0.1:3002/api/verify", {
+      "x-original-host": "admin.example.test",
+      "x-original-proto": "https",
+      "x-original-uri": "/settings",
+    });
+    const response = redirectToLogin(ctx, "/sign-in", {
+      allowedHosts: ["admin.example.test"],
+    });
+    const location = new URL(response.headers.get("location")!);
+
+    expect(location.origin).toBe("https://sso.example.test");
+    expect(location.pathname).toBe("/sign-in");
+    expect(location.searchParams.get("returnTo")).toBe("https://admin.example.test/settings");
+  } finally {
+    if (previous === undefined) delete process.env.WRNEXUS_APP_ORIGIN;
+    else process.env.WRNEXUS_APP_ORIGIN = previous;
+  }
+});
+
 test("supports an allowed-host callback and custom response options", () => {
   const ctx = context("https://login.example.test/api/verify", {
     "x-forwarded-host": "reports.example.test",