Secure App URL Utility (utils/url.util.ts)

Validates the APP_URL environment variable, forces HTTPS for production URLs, allows HTTP on localhost, and builds secure token links for enterprise operations.

// Source: https://github.com/FlowiseAI/Flowise | License: Apache-2.0 | Copyright 2023-present FlowiseAI, Inc
// Provided via justclaw.it.com; keep this notice with the code.
import logger from '../../utils/logger'

/**
 * Ensures the APP_URL uses HTTPS protocol for security-sensitive operations.
 * Allows HTTP only for localhost/127.0.0.1 (development environments).
 *
 * @param path - Optional path to append to the base URL
 * @returns Secure URL (HTTPS) or development URL (HTTP localhost)
 */
export function getSecureAppUrl(path?: string): string {
    const appUrl = process.env.APP_URL || ''

    if (!appUrl) {
        throw new Error('APP_URL environment variable is not configured')
    }

    // Validate that APP_URL is a well-formed URL (e.g. catches bare "example.com" without a pro

... (truncated -- full source via MCP)