Deployment fixes

Author: Rajat

apps/api/Dockerfile

@@ -11,6 +11,7 @@ COPY pnpm-workspace.yaml ./
 COPY apps/api ./apps/api
 COPY packages/api-contract ./packages/api-contract
 COPY packages/email-editor ./packages/email-editor
+COPY packages/email-blocks ./packages/email-blocks
 
 RUN pnpm install --frozen-lockfile
 
@@ -20,6 +21,7 @@ COPY --from=deps /app/ ./
 
 RUN pnpm --filter=@sendlit/email-editor build
 RUN pnpm --filter=@sendlit/api-contract build
+RUN pnpm --filter=@sendlit/email-blocks build
 RUN pnpm --filter=@sendlit/api build
 
 FROM base AS runner
@@ -37,6 +39,9 @@ COPY --chown=nodeuser:nodejs --from=builder /app/pnpm-workspace.yaml ./
 COPY --chown=nodeuser:nodejs --from=builder /app/packages/email-editor/package.json ./packages/email-editor/package.json
 COPY --chown=nodeuser:nodejs --from=builder /app/packages/email-editor/dist ./packages/email-editor/dist
 
+COPY --chown=nodeuser:nodejs --from=builder /app/packages/email-blocks/package.json ./packages/email-blocks/package.json
+COPY --chown=nodeuser:nodejs --from=builder /app/packages/email-blocks/dist ./packages/email-blocks/dist
+
 COPY --chown=nodeuser:nodejs --from=builder /app/packages/api-contract/package.json ./packages/api-contract/package.json
 COPY --chown=nodeuser:nodejs --from=builder /app/packages/api-contract/dist ./packages/api-contract/dist
 

apps/web/app/api/auth/[...path]/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { API_URL } from "@/lib/config";
+import { safeAppRedirect } from "@/lib/safe-app-redirect";
 
 async function proxyAuth(req: NextRequest, path: string[]) {
     const upstreamUrl = new URL(
@@ -42,7 +43,9 @@ async function proxyAuth(req: NextRequest, path: string[]) {
         path[0] === "sign-out" &&
         upstream.ok
     ) {
-        const response = NextResponse.redirect(new URL("/login", req.url), {
+        // Use WEB_CLIENT, not req.url — behind a reverse proxy req.url can be
+        // the container bind host (0.0.0.0:3000).
+        const response = NextResponse.redirect(safeAppRedirect("/login"), {
             status: 303,
         });
         for (const cookie of upstream.headers.getSetCookie()) {

apps/web/app/api/team/switch/route.test.ts

@@ -1,9 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { NextRequest } from "next/server";
 
-function request(fields: Record<string, string>) {
+function request(fields: Record<string, string>, url?: string) {
     const body = new URLSearchParams(fields);
-    return new NextRequest("http://localhost:3000/api/team/switch", {
+    return new NextRequest(url ?? "http://localhost:3000/api/team/switch", {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
         body,
@@ -13,6 +13,7 @@ function request(fields: Record<string, string>) {
 describe("team switch", () => {
     beforeEach(() => {
         vi.unstubAllEnvs();
+        vi.resetModules();
     });
 
     it("sets the selected team and redirects within the application", async () => {
@@ -21,6 +22,7 @@ describe("team switch", () => {
             request({ teamId: "team_123", redirectTo: "/contacts?from=team" }),
         );
 
+        expect(response.status).toBe(303);
         expect(response.headers.get("location")).toBe(
             "http://localhost:3000/contacts?from=team",
         );
@@ -31,6 +33,22 @@ describe("team switch", () => {
         expect(response.headers.get("set-cookie")).not.toContain("HttpOnly");
     });
 
+    it("redirects using WEB_CLIENT even when req.url is the container bind address", async () => {
+        vi.stubEnv("WEB_CLIENT", "https://app.sendlit.clqa.site");
+        vi.resetModules();
+        const { POST } = await import("./route");
+        const response = await POST(
+            request(
+                { teamId: "team_123", redirectTo: "/teams" },
+                "http://0.0.0.0:3000/api/team/switch",
+            ),
+        );
+
+        expect(response.headers.get("location")).toBe(
+            "https://app.sendlit.clqa.site/teams",
+        );
+    });
+
     it.each(["https://attacker.example/steal", "//attacker.example/steal"])(
         "rejects an external redirect target: %s",
         async (redirectTo) => {

apps/web/app/api/team/switch/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { safeAppRedirect } from "@/lib/safe-app-redirect";
 import { TEAM_ID_COOKIE } from "@/lib/tokens";
 
 /**
@@ -7,19 +8,18 @@ import { TEAM_ID_COOKIE } from "@/lib/tokens";
  * `apps/api/src/auth/require-team.ts`). Submitted as a regular form POST
  * (same pattern as `/api/auth/logout`) so switching works with a plain
  * `<form>`, no client JS required.
+ *
+ * Redirects use `WEB_CLIENT` (via `safeAppRedirect`) rather than `req.url`,
+ * so reverse-proxied deploys don't send the browser to the container bind
+ * address (`0.0.0.0:3000`).
  */
 export async function POST(req: NextRequest) {
     const form = await req.formData();
     const teamId = String(form.get("teamId") || "");
     const redirectTo = String(form.get("redirectTo") || "/");
 
-    const requestUrl = new URL(req.url);
-    const requestedRedirect = new URL(redirectTo, requestUrl);
-    const redirectUrl =
-        requestedRedirect.origin === requestUrl.origin
-            ? requestedRedirect
-            : new URL("/", requestUrl);
-    const res = NextResponse.redirect(redirectUrl);
+    // 303: after a form POST, follow the redirect with GET (not re-POST).
+    const res = NextResponse.redirect(safeAppRedirect(redirectTo), 303);
     if (teamId) {
         const isProd = process.env.NODE_ENV === "production";
         // Not httpOnly, deliberately: this is just a "which team am I looking

apps/web/lib/safe-app-redirect.test.ts

@@ -0,0 +1,62 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+describe("safeAppRedirect", () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+        vi.resetModules();
+    });
+
+    async function loadWithWebClient(webClient: string) {
+        vi.stubEnv("WEB_CLIENT", webClient);
+        vi.resetModules();
+        return import("./safe-app-redirect");
+    }
+
+    it("resolves relative paths against WEB_CLIENT", async () => {
+        const { safeAppRedirect } = await loadWithWebClient(
+            "https://app.sendlit.clqa.site",
+        );
+
+        expect(safeAppRedirect("/teams").toString()).toBe(
+            "https://app.sendlit.clqa.site/teams",
+        );
+        expect(safeAppRedirect("/contacts?from=team").toString()).toBe(
+            "https://app.sendlit.clqa.site/contacts?from=team",
+        );
+    });
+
+    it("allows absolute URLs on the same public origin", async () => {
+        const { safeAppRedirect } = await loadWithWebClient(
+            "https://app.sendlit.example",
+        );
+
+        expect(
+            safeAppRedirect("https://app.sendlit.example/settings").toString(),
+        ).toBe("https://app.sendlit.example/settings");
+    });
+
+    it.each([
+        "https://attacker.example/steal",
+        "//attacker.example/steal",
+        "https://app.sendlit.evil/teams",
+    ])("rejects external redirect target %s", async (redirectTo) => {
+        const { safeAppRedirect } = await loadWithWebClient(
+            "https://app.sendlit.example",
+        );
+
+        expect(safeAppRedirect(redirectTo).toString()).toBe(
+            "https://app.sendlit.example/",
+        );
+    });
+
+    it("falls back to home for empty or invalid targets", async () => {
+        const { safeAppRedirect } = await loadWithWebClient(
+            "http://localhost:3000",
+        );
+
+        expect(safeAppRedirect("").toString()).toBe("http://localhost:3000/");
+        expect(safeAppRedirect("not a url").toString()).toBe(
+            "http://localhost:3000/",
+        );
+    });
+});

apps/web/lib/safe-app-redirect.ts

@@ -0,0 +1,35 @@
+import { WEB_CLIENT } from "@/lib/config";
+
+/**
+ * Resolve a post-action redirect against this app's public origin
+ * (`WEB_CLIENT`), not `req.url`.
+ *
+ * Behind a reverse proxy the Next.js standalone server binds to
+ * `HOSTNAME=0.0.0.0`, so `req.url` / `req.nextUrl.origin` become
+ * `http://0.0.0.0:3000` (or similar). Building `Location` from that sends
+ * the browser to an unreachable address. `WEB_CLIENT` is already the
+ * canonical public origin used for auth return URLs.
+ *
+ * Only same-origin targets are allowed (relative paths, or absolute URLs
+ * whose origin matches `WEB_CLIENT`). Everything else falls back to `/`.
+ */
+export function safeAppRedirect(redirectTo: string): URL {
+    const appOrigin = new URL(WEB_CLIENT);
+
+    try {
+        // Protocol-relative URLs (`//evil.example/...`) must not be treated
+        // as relative paths — `new URL("//…", origin)` would rewrite the host.
+        if (redirectTo.startsWith("/") && !redirectTo.startsWith("//")) {
+            return new URL(redirectTo, appOrigin);
+        }
+
+        const absolute = new URL(redirectTo);
+        if (absolute.origin === appOrigin.origin) {
+            return absolute;
+        }
+    } catch {
+        // Invalid URL — fall through to the home path.
+    }
+
+    return new URL("/", appOrigin);
+}