fix(auth): build password-reset links from an operator-set public address, never the Host header (M462 #4981)

buildResetURL used r.Host and r.TLS, so a forgot-password request with a
forged Host emailed the victim a real reset token on a link to the
attacker's server. Links now come only from network_settings.public_url
(migration 0062), and no reset email is sent while it is empty; the response
stays the same opaque 200 and the log says why.

The address is set on a new "Public address" card under Admin → Integrations,
which offers the page's own origin and warns while unset. PUT
/api/admin/network-settings takes either field alone, so the proxy card and
this one can't overwrite each other.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/auth_forgot_test.go

@@ -7,11 +7,59 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"testing"
 
+	"github.com/jackc/pgx/v5/pgxpool"
+
 	"git.fabledsword.com/bvandeusen/minstrel/internal/mailer"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/netsettings"
 )
 
+// withPublicURL gives h a network-settings service holding url, restoring an
+// empty value afterwards so other tests see the default.
+func withPublicURL(t *testing.T, h *handlers, pool *pgxpool.Pool, url string) {
+	t.Helper()
+	ns, err := netsettings.New(context.Background(), pool, nil)
+	if err != nil {
+		t.Fatalf("netsettings: %v", err)
+	}
+	if err := ns.SetPublicURL(context.Background(), url); err != nil {
+		t.Fatalf("set public url: %v", err)
+	}
+	t.Cleanup(func() { _ = ns.SetPublicURL(context.Background(), "") })
+	h.netSettings = ns
+}
+
+// With no public URL set, a reset email is not sent at all, and the response
+// is still the same opaque 200.
+func TestForgotPassword_NoPublicURL_SendsNothing(t *testing.T) {
+	if os.Getenv("MINSTREL_TEST_DATABASE_URL") == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	h, pool := testHandlers(t)
+	fake := &mailer.FakeSender{}
+	h.mailer = fake
+	withPublicURL(t, h, pool, "")
+
+	user := seedUser(t, pool, "nourl", "pw", false)
+	if _, err := pool.Exec(context.Background(),
+		"UPDATE users SET email = 'nourl@example.com' WHERE id = $1", user.ID); err != nil {
+		t.Fatalf("seed email: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/auth/forgot-password",
+		bytes.NewReader([]byte(`{"email":"nourl@example.com"}`)))
+	rec := httptest.NewRecorder()
+	h.handleForgotPassword(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Errorf("status = %d, want 200", rec.Code)
+	}
+	if len(fake.Sent) != 0 {
+		t.Errorf("sent %d emails with no public URL set, want 0", len(fake.Sent))
+	}
+}
+
 func TestForgotPassword_KnownEmail_SendsMail(t *testing.T) {
 	if os.Getenv("MINSTREL_TEST_DATABASE_URL") == "" {
 		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
@@ -19,6 +67,7 @@ func TestForgotPassword_KnownEmail_SendsMail(t *testing.T) {
 	h, pool := testHandlers(t)
 	fake := &mailer.FakeSender{}
 	h.mailer = fake
+	withPublicURL(t, h, pool, "https://music.example.com")
 
 	user := seedUser(t, pool, "forgotuser", "pw", false)
 	if _, err := pool.Exec(context.Background(),
@@ -29,7 +78,8 @@ func TestForgotPassword_KnownEmail_SendsMail(t *testing.T) {
 	body := `{"email":"forgot@example.com"}`
 	req := httptest.NewRequest(http.MethodPost, "/api/auth/forgot-password",
 		bytes.NewReader([]byte(body)))
-	req.Host = "minstrel.example.com"
+	// A forged Host must not reach the link: it comes from the public URL.
+	req.Host = "attacker.example.net"
 	rec := httptest.NewRecorder()
 	h.handleForgotPassword(rec, req)
 
@@ -43,6 +93,12 @@ func TestForgotPassword_KnownEmail_SendsMail(t *testing.T) {
 	if got.To != "forgot@example.com" {
 		t.Errorf("To = %q, want forgot@example.com", got.To)
 	}
+	if !strings.Contains(got.TextBody, "https://music.example.com/reset-password/") {
+		t.Errorf("reset link not built from the public URL:\n%s", got.TextBody)
+	}
+	if strings.Contains(got.TextBody+got.HTMLBody, "attacker.example.net") {
+		t.Error("the request's Host header reached the emailed link")
+	}
 	// Token row was inserted.
 	var tokenCount int
 	if err := pool.QueryRow(context.Background(),