Let a preview sign in on its alias URL

[NitzanSirota]

Follow-up to #23. The redirect proxy shipped there works — production forwards the callback correctly — but no preview could actually complete a sign-in.

The bug

Netlify answers the deploy alias (deploy-preview-N--<site>.netlify.app) with a 200, but hands the Next.js server handler the deploy permalink (<deploy-id>--<site>.netlify.app) in host / x-forwarded-host. Measured on the live deployments — /api/auth/providers on PR #24's alias reported the permalink as its own callbackUrl.

So, with the origin derived from the request:

1. the browser sits on the alias, and the state cookie is set there — cookies are host-only;
2. the function believes it is the permalink, and encodes that origin into the OAuth state;
3. production faithfully forwards the callback to the permalink, which holds no state cookie.

Sign-in fails as InvalidCheck: state value could not be parsed. That message is misleading: parseCookie in @auth/core wraps every cause — a missing cookie included — into that one string, which is why this first looked like a stale cookie or a database problem.

The fix

Netlify's own DEPLOY_PRIME_URL is the alias, so pin AUTH_URL to it.

• next.config.ts bakes it in at build time, because the function's runtime environment does not carry Netlify's build variables.
• src/lib/auth.ts applies the pin only when neither AUTH_URL nor NEXTAUTH_URL is already set, so production (which sets NEXTAUTH_URL) and local dev (which sets neither) are unchanged. AUTH_URL is the only channel available — v5 has no url config option.

Verification

Built with DEPLOY_PRIME_URL=http://pinned-alias.example, served it, and sent a request with Host: 6a97fdd1--permalink.netlify.app:

• decoded OAuth state → origin: http://pinned-alias.example/api/auth/callback/google — the pinned value, not the host;
• redirect_uri → still production's callback, so the proxy is untouched.

npm run typecheck clean, npm run lint at its two pre-existing exhaustive-deps warnings, npm run build exit 0.

What this PR's own preview proves: curl -s <this preview's alias>/api/auth/providers should report the alias as callbackUrl. If it still reports the permalink, DEPLOY_PRIME_URL was absent from the build environment and the bake came out empty — the one step that cannot be verified off-platform.

Trade-off

A preview now signs in on its alias URL only. Opening the permalink directly puts the browser on a host the deployment no longer claims. Documented in docs/deploy.md.

No Netlify configuration changes required.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for base44-platform-starter ready!

Name	Link
🔨 Latest commit	e4d10ee
🔍 Latest deploy log	https://app.netlify.com/projects/base44-platform-starter/deploys/6a9805426718670008e3f0d1
😎 Deploy Preview	https://deploy-preview-25--base44-platform-starter.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.