fix: use NEXT_PUBLIC_APP_URL for affiliate fallback redirects

[MD-Mushfiqur123]

What

Replaces request.url with NEXT_PUBLIC_APP_URL for fallback redirects in the affiliate click endpoint.

Why

Closes #94. Behind Railway's reverse proxy, request.url contains the internal server URL (http://localhost:8080) instead of the public-facing URL. This causes fallback redirects to send users to an unreachable localhost URL.

How

Changed three fallback redirects in src/app/api/affiliates/click/route.ts:

• Missing ref param
• Invalid/unknown ref
• Catch-all error handler

All now use process.env.NEXT_PUBLIC_APP_URL || "https://ugig.net" as the base URL, matching the pattern already used elsewhere in the same file.

Testing

• Code compiles and follows existing patterns
• Uses same env var approach already proven in the file

[greptile-apps]

Greptile Summary

Fixes fallback redirects in the affiliate click endpoint that were sending users to http://localhost:8080 when running behind Railway's reverse proxy, by replacing request.url with process.env.NEXT_PUBLIC_APP_URL || \"https://ugig.net\" — the same pattern already used in the happy-path redirect logic.

• Three redirect sites updated (missing ref, unknown ref, catch-all error handler), eliminating unreachable localhost redirects for end users.
• request.url is still used on line 54 as the landedUrl passed to recordClick, meaning affiliate click records will continue to store the internal proxy URL rather than the real public URL — a data quality concern for analytics not addressed by this PR.

Confidence Score: 4/5

Safe to merge — all three fallback redirects now point to the correct public URL, resolving the user-facing broken redirect behind Railway's proxy.

The redirect fix is correct and consistent with the existing pattern in the same file. The one residual gap is that landedUrl in recordClick still captures the internal localhost:8080 URL, so affiliate analytics will store inaccurate click origins, but this does not affect end-user functionality.

The recordClick call on line 54 of src/app/api/affiliates/click/route.ts deserves a follow-up to swap request.url for the public URL, mirroring this PR's approach.

Important Files Changed

Filename	Overview
src/app/api/affiliates/click/route.ts	Three fallback redirects updated to use NEXT_PUBLIC_APP_URL instead of request.url, matching the existing pattern in the happy path. Minor: landedUrl in recordClick still uses request.url (proxy-internal URL persisted to analytics), and the APP_URL expression is repeated five times.

Sequence Diagram

sequenceDiagram
    participant User
    participant Railway Proxy
    participant Next.js Handler
    participant Supabase

    User->>Railway Proxy: GET /api/affiliates/click?ugig_ref=CODE
    Railway Proxy->>Next.js Handler: forwards request (request.url = localhost:8080/...)

    alt Missing ugig_ref param
        Next.js Handler-->>User: redirect(NEXT_PUBLIC_APP_URL + /affiliates) fixed
    else
        Next.js Handler->>Supabase: lookup tracking_code
        alt Unknown / unapproved ref
            Next.js Handler-->>User: redirect(NEXT_PUBLIC_APP_URL + /affiliates) fixed
        else Valid ref
            Next.js Handler->>Supabase: recordClick(landedUrl=request.url still localhost)
            Next.js Handler-->>User: redirect to offer URL + set cookies
        end
    end

    alt Unhandled exception
        Next.js Handler-->>User: redirect(NEXT_PUBLIC_APP_URL + /affiliates) fixed
    end

Loading

Comments Outside Diff (2)

1. src/app/api/affiliates/click/route.ts, line 54 (link)

   landedUrl still records the internal proxy URL

   request.url on line 54 is passed as landedUrl to recordClick. Behind Railway's reverse proxy, this will persist http://localhost:8080/api/affiliates/click?ugig_ref=… into the click record instead of the real public-facing URL. The fix in this PR correctly addresses fallback redirects, but the same root cause affects affiliate analytics data — any dashboard or query reading landed_url will see internal addresses rather than the actual entry URL.

2. src/app/api/affiliates/click/route.ts, line 10-12 (link)

   The process.env.NEXT_PUBLIC_APP_URL || "https://ugig.net" expression is now evaluated five separate times across this file. Extracting it as a module-level constant makes future changes to the fallback value a one-line edit and avoids silent drift if any instance is updated independently.

_{Reviews (1): Last reviewed commit: "fix: use NEXT_PUBLIC_APP_URL for affilia..." | Re-trigger Greptile}