Merge remote-tracking branch 'origin/master'

svc/internal/security/password_reset.go

@@ -2,12 +2,28 @@ package security
 
 import (
 	"os"
+	"strings"
 )
 
 func BuildResetURL(token string) string {
-	base := os.Getenv("FRONTEND_URL")
+	base := os.Getenv("APP_FRONTEND_URL")
+	if base == "" {
+		base = os.Getenv("FRONTEND_URL")
+	}
 	if base == "" {
 		base = "http://localhost:9000"
 	}
-	return base + "/password-reset/" + token
+	base = strings.TrimRight(base, "/")
+	// If base already points to password-reset, just append token if needed.
+	if strings.Contains(base, "/password-reset") {
+		if strings.HasSuffix(base, "/password-reset") || strings.HasSuffix(base, "/password-reset/") ||
+			strings.HasSuffix(base, "/#/password-reset") || strings.HasSuffix(base, "/#/password-reset/") {
+			return strings.TrimRight(base, "/") + "/" + token
+		}
+		return base
+	}
+	if strings.Contains(base, "#") {
+		return base + "/password-reset/" + token
+	}
+	return base + "/#/password-reset/" + token
 }