fix: affiliate click fallback redirects to localhost in production

[pxivory-max]

Summary

• Fixes fallback redirects in GET /api/affiliates/click that resolve to localhost:8080 behind Railway's reverse proxy
• Uses NEXT_PUBLIC_APP_URL (already available in the same file) as the base URL for all redirect fallbacks
• All 3 fallback paths (missing ref, invalid tracking code, catch block) are fixed

Fixes #94

Context

This is part of testing the affiliate/invite-friends flow for the gig:
https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae

Test plan

• Verify curl -si "https://ugig.net/api/affiliates/click" returns 307 to https://ugig.net/affiliates (not localhost)
• Verify curl -si "https://ugig.net/api/affiliates/click?ugig_ref=invalid" also redirects to public URL
• All existing tests pass (1347 tests green)
• TypeScript type check passes
• ESLint passes

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR fixes a production bug where the GET /api/affiliates/click route was redirecting users to localhost:8080 in fallback paths because request.url was used as the base URL — resolving to the internal host behind Railway's reverse proxy instead of the public domain.

• Moves the appUrl constant (sourced from NEXT_PUBLIC_APP_URL) above the try block so it is available to all three fallback NextResponse.redirect calls (missing ref, invalid tracking code, and catch block).
• The catch block introduces a separate appFallback variable for the same value instead of reusing the already-in-scope appUrl, which is a minor inconsistency worth cleaning up.

Confidence Score: 4/5

The fix correctly addresses the localhost redirect issue for all three fallback paths and is safe to merge.

The core bug fix is correct — moving appUrl before the try block ensures all redirect fallbacks use the configured public URL. The only rough edge is a redundant appFallback variable in the catch block that duplicates appUrl already in scope, which is a cleanup opportunity but not a functional problem.

No files require special attention beyond the minor appFallback redundancy in the catch block of route.ts.

Important Files Changed

Filename	Overview
src/app/api/affiliates/click/route.ts	Moves appUrl declaration before the try block so all three redirect fallbacks use the configured public URL instead of request.url (which resolves to localhost behind Railway's proxy). The catch block introduces a redundant appFallback variable instead of reusing the already-scoped appUrl.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Railway Proxy
    participant NextJS as Next.js /api/affiliates/click
    participant Supabase

    Client->>Railway Proxy: GET /api/affiliates/click?ugig_ref=CODE
    Railway Proxy->>NextJS: forwards request (request.url = localhost:8080/...)
    
    alt No ref param
        NextJS-->>Client: 307 redirect → appUrl + /affiliates (FIXED)
    else ref param present
        NextJS->>Supabase: lookup affiliate_application by tracking_code
        alt Not found / not approved
            NextJS-->>Client: 307 redirect → appUrl + /affiliates (FIXED)
        else Found
            NextJS->>Supabase: recordClick(...)
            NextJS-->>Client: 307 redirect → offer destination URL
        end
    else Unhandled error
        NextJS-->>Client: 307 redirect → appUrl + /affiliates (FIXED)
    end

Loading

_{Reviews (1): Last reviewed commit: "fix: use NEXT_PUBLIC_APP_URL for affilia..." | Re-trigger Greptile}

[greptile-apps]

The appFallback variable in the catch block is redundant — appUrl (declared on line 11, outside the try block) is already in scope here and holds the same value. Re-reading the env var creates a second source of truth for the same constant, which could cause a silent mismatch if the fallback string is ever changed in one place but not the other.

Suggested change

	} catch (err) {
	console.error("Affiliate click error:", err);
	return NextResponse.redirect(new URL("/affiliates", request.url));
	const appFallback = process.env.NEXT_PUBLIC_APP_URL || "https://ugig.net";
	return NextResponse.redirect(new URL("/affiliates", appFallback));
	}
	} catch (err) {
	console.error("Affiliate click error:", err);
	return NextResponse.redirect(new URL("/affiliates", appUrl));
	}