Method hasUsableBaseURL

internal/server/server.go:556–596

hasUsableBaseURL reports whether s.baseURL is a URL a verification-email recipient on the public internet can actually reach. It supersets the unreachable-host warning in SetBaseURL (BUG-899): the bind-all hosts 0.0.0.0 / :: are the right thing to bind() to but the wrong thing to email, and so is ev

()

// than minting a write-locked user). Self-host and admin/invitation signup are
// unaffected either way.
func (s *Server) hasUsableBaseURL() bool {
	if s.baseURL == "" {
		return false
	}
	u, err := url.Parse(s.baseURL)
	if err != nil {
		return false
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return false
	}
	// The verification link is built by concatenation (baseURL +
	// "/verify-email/" + token), so a base URL carrying a query or fragment
	// would push the route into the query/fragment and break the link.
	if u.RawQuery != "" || u.Fragment != "" {
		return false
	}
	host := u.Hostname()
	if host == "" {
		return false
	}
	// A present port must be a valid TCP port (1–65535); url.Parse accepts
	// out-of-range numeric ports that no client can actually connect to.
	if p := u.Port(); p != "" {
		n, perr := strconv.Atoi(p)
		if perr != nil || n < 1 || n > 65535 {
			return false
		}
	}

	// Reject literal IPs outright — a usable public verification endpoint is a
	// DNS hostname, and "is this IP publicly reachable" is not decidable from a
	// finite denylist. Fail closed on any IP.
	if _, aerr := netip.ParseAddr(host); aerr == nil {
		return false
	}

	// The host must be a syntactically-valid, multi-label public FQDN (rejects
	// malformed hosts like ".com", "foo..com", "-a.com" and special-use TLDs).
	return isPublicDNSName(host)
}

// isPublicDNSName reports whether host is a syntactically-valid public FQDN
// (RFC 1123 labels) whose TLD is neither a special-use reserved name nor