@@ -195,8 +195,8 @@ export const sendEmailLink = async (
195195
196196 // Check if this is a localhost-style domain before building hostname
197197 // TODO: Security consideration - this only affects localhost domains which
198- // should not exist in production. The isLocalHost check combined with isDryRun
199- // ensures special behavior (http, custom port) only applies in dev environments.
198+ // should not exist in production. The isLocalHost check ensures special
199+ // behavior (http, custom port) only applies in dev environments.
200200 const isLocalDomain =
201201 domain === 'localhost' ||
202202 domain . startsWith ( 'localhost' ) ||
@@ -215,17 +215,11 @@ export const sendEmailLink = async (
215215 hostname . startsWith ( '0.0.0.0' ) ||
216216 hostname . endsWith ( '.localhost' ) ;
217217
218- // Optional: LOCAL_APP_PORT lets you attach a port for local dashboards
219- // e.g. LOCAL_APP_PORT=3000 -> http://localhost:3000
220- // It is ignored for non-local hostnames. Only allow on DRY RUNs
221- const localPort =
222- isLocalHost && isDryRun && process . env . LOCAL_APP_PORT
223- ? `:${ process . env . LOCAL_APP_PORT } `
224- : '' ;
225-
226- // Use http only for local dry-run to avoid browser TLS warnings
227- // in dev; production stays https.
228- const protocol = isLocalHost && isDryRun ? 'http' : 'https' ;
218+ // When localhost + LOCAL_APP_PORT: use http://localhost:PORT (local dev)
219+ // Otherwise: https (production)
220+ const useLocalUrl = isLocalHost && process . env . LOCAL_APP_PORT ;
221+ const localPort = useLocalUrl ? `:${ process . env . LOCAL_APP_PORT } ` : '' ;
222+ const protocol = useLocalUrl ? 'http' : 'https' ;
229223 const url = new URL ( `${ protocol } ://${ hostname } ${ localPort } ` ) ;
230224
231225 let subject : string ;
0 commit comments