fix(auth): use public URL for magic-link redirects

design/log.md

@@ -2,6 +2,7 @@
 
 ## 2026-08-01
 
+* **Fix**: Build magic-link redirects from the configured public portal URL instead of the reverse proxy's internal request origin.
 * **Verify**: Confirmed `v1.1.1` left all pre-existing `latest` digests unchanged while publishing versioned artifacts.
 * **Refine**: Removed mutable `latest` publication so all deployable artifacts use explicit semantic versions.
 * **Verify**: Confirmed the `v1.1.0` Discord bot image and matching web, migration, and Velocity artifacts.

design/us-002-discord-magic-link.md

@@ -3,7 +3,7 @@ type: User Story
 title: Authenticate with a Discord magic link
 description: Discord users receive private single-use links that establish secure portal sessions.
 tags: [player, discord, authentication, security]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T20:43:46Z
 story_id: US-002
 status: verified
 ---
@@ -19,6 +19,7 @@ As a Discord community member, I want `/register` and `/account` to issue a priv
 - [x] Given a login token, then it expires after ten minutes and can be consumed only once.
 - [x] Given repeated link requests, then requests are rate limited per Discord user and older active links are invalidated.
 - [x] Given a valid link, when it is consumed, then the Discord user is created or refreshed and a secure seven-day session is established.
+- [x] Given a magic-link result behind a reverse proxy, then the browser is redirected through the configured public application URL rather than an internal container address.
 - [x] Given an invalid, expired, or consumed link, then the user sees a safe recovery page instructing them to request another link.
 
 # Implementation
@@ -27,10 +28,12 @@ As a Discord community member, I want `/register` and `/account` to issue a priv
 - [`packages/auth/src/index.ts`](../packages/auth/src/index.ts)
 - [`packages/database/src/auth-repository.ts`](../packages/database/src/auth-repository.ts)
 - [`apps/web/src/app/auth/discord/route.ts`](../apps/web/src/app/auth/discord/route.ts)
+- [`apps/web/src/lib/application-url.ts`](../apps/web/src/lib/application-url.ts)
 
 # Validation
 
 - [`packages/auth/test/magic-link.test.ts`](../packages/auth/test/magic-link.test.ts)
+- [`apps/web/src/lib/application-url.test.ts`](../apps/web/src/lib/application-url.test.ts)
 - Discord command and authentication workspaces pass TypeScript validation.
 
 # Related Stories