Fix localhost redirect URLs on Railway/reverse proxy deployments

[cavewebs]

Problem

On https://demo.dashcommerce.dev (Railway + Neon deployment), redirect URLs were using http://localhost:8080 instead of the public domain:

• Stripe checkout success redirects: http://localhost:8080/thank-you/<id>?session_id=...
• Admin vendor invite links: http://localhost:8080/vendor/...
• Billing portal return URLs: http://localhost:8080/account

Root Causes (Two Issues)

1. Request URL Behind Reverse Proxy

The code was extracting the origin from routeCtx.request.url, which contains the internal routing URL when behind a reverse proxy. Railway (and similar platforms) route traffic through an internal network where the app listens on localhost:8080, while the public domain is handled by the proxy.

2. Stale Database Option

The live Neon database had:

emdash:site_url = "http://localhost:8080"  ← Stale from dev/setup

While the environment variable was correct (SITE_URL=https://demo.dashcommerce.dev), this stale database option may have been read by EmDash core or could interfere with site URL resolution.

Solution

Code Hardening

Created getPublicSiteUrl() helper in util/site-url.ts that:

• Uses ctx.site.url (from SITE_URL env var) instead of request.url.origin
• Validates the URL is configured (throws if missing)
• Logs warnings if localhost is detected in production
• Strips trailing slashes for clean URL construction
• Provides isProductionSiteUrl() utility for conditional logic

Files changed:

• packages/core/src/util/site-url.ts - New helper module
• packages/core/src/routes/checkout.ts - Stripe checkout success/cancel URLs
• packages/core/src/routes/subscriptions-public.ts - Billing portal return URL
• packages/core/src/routes/customer-portal.ts - Customer portal return URL

Database Cleanup (Recommended)

Parent is handling cleanup of the stale database option:

UPDATE options 
SET value = '"https://demo.dashcommerce.dev"'
WHERE key = 'emdash:site_url';

The code fix ensures correct behavior even if this option remains stale, but cleaning it up prevents debugging confusion.

Required Configuration

Deployments must set the SITE_URL environment variable to the public domain:

SITE_URL=https://demo.dashcommerce.dev

Railway already has this configured for the demo. No application code changes or restarts needed beyond deploying this PR.

Testing

To verify on the live demo after deployment:

1. Complete a Stripe test checkout
2. Verify the success redirect goes to https://demo.dashcommerce.dev/thank-you/...
3. Create a vendor invite in admin
4. Verify the invite link uses https://demo.dashcommerce.dev/vendor/...
5. Check logs for any "Site URL is localhost" warnings (should be none after DB cleanup)

Documentation

See LOCALHOST_REDIRECT_FIX.md for:

• Complete technical analysis
• SQL queries to check/fix database options
• Database option vs environment variable hierarchy
• Verification procedures
• Platform-specific configuration guidance

Design Decision

The helper warns but allows localhost URLs to support development and testing environments. In production with SITE_URL set correctly, no warnings will appear. This design:

• Fails fast if SITE_URL is completely missing
• Aids debugging when misconfigured
• Doesn't break local development
• Centralizes URL validation logic