fix(auth): always redirect to canonical domain after OAuth, remove dynamic origin dependency

src/app/auth/callback/route.ts

@@ -2,8 +2,14 @@ import { createServerClient } from "@supabase/ssr";
 import { cookies } from "next/headers";
 import { NextResponse } from "next/server";
 
+// Always redirect to the canonical domain after OAuth so that arriving via
+// any auto-assigned Vercel URL (e.g. studymapp-student-suite.vercel.app)
+// doesn't leave the user stranded on the wrong domain.
+const SITE_URL =
+  process.env.NEXT_PUBLIC_SITE_URL ?? "https://studymapp.vercel.app";
+
 export async function GET(request: Request) {
-  const { searchParams, origin } = new URL(request.url);
+  const { searchParams } = new URL(request.url);
   const code = searchParams.get("code");
   const next = searchParams.get("next") ?? "/";
 
@@ -28,9 +34,9 @@ export async function GET(request: Request) {
 
     const { error } = await supabase.auth.exchangeCodeForSession(code);
     if (!error) {
-      return NextResponse.redirect(`${origin}${next}`);
+      return NextResponse.redirect(`${SITE_URL}${next}`);
     }
   }
 
-  return NextResponse.redirect(`${origin}/login?error=auth_error`);
+  return NextResponse.redirect(`${SITE_URL}/login?error=auth_error`);
 }

src/app/login/login-form.tsx

@@ -6,6 +6,7 @@ import { toast } from "sonner";
 import { Loader2 } from "lucide-react";
 
 import { createClient } from "@/lib/supabase/client";
+import { site } from "@/lib/site";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -50,7 +51,10 @@ export function LoginForm() {
   }
 
   async function handleGoogle() {
-    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? window.location.origin;
+    // Use the explicit env var for local dev (http://localhost:3000),
+    // fall back to the hardcoded canonical domain so any auto-assigned
+    // Vercel URL never leaks into the OAuth redirectTo.
+    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? site.url;
     const { error } = await supabase.auth.signInWithOAuth({
       provider: "google",
       options: {