fix(mcp): derive OAuth login redirect and well-known discovery from request base URL

apps/nextjs/next.config.ts

@@ -64,6 +64,15 @@ const nextConfig: NextConfig = {
       },
     ],
   },
+  // skipcq: JS-0116
+  // eslint-disable-next-line @typescript-eslint/require-await,no-restricted-syntax
+  async rewrites() {
+    return [
+      { source: "/.well-known/:path*", destination: "/well-known/:path*" },
+      { source: "/api/mcp/:transport/.well-known/:path*", destination: "/well-known/:path*" },
+    ];
+  },
+
   // skipcq: JS-0116
   // eslint-disable-next-line @typescript-eslint/require-await,no-restricted-syntax
   async headers() {

apps/nextjs/src/app/api/mcp/oauth/authorize/route.ts

@@ -1,5 +1,6 @@
 import type { NextRequest } from "next/server";
 
+import { extractBaseUrlFromHeaders } from "@homarr/common";
 import { auth } from "@homarr/auth/next";
 
 import { consumePendingAuth, createAuthCode, getClient, storePendingAuth } from "../_store";
@@ -137,7 +138,8 @@ export async function GET(req: NextRequest) {
     );
   }
 
-  const loginUrl = new URL("/auth/login", url.origin);
+  const baseUrl = extractBaseUrlFromHeaders(req.headers);
+  const loginUrl = new URL("/auth/login", baseUrl);
   loginUrl.searchParams.set("callbackUrl", `/api/mcp/oauth/authorize?pending=${id}`);
   return Response.redirect(loginUrl.toString());
 }