feat: sync public links and phone change updates

internal/links/links.go

@@ -1,6 +1,7 @@
 package links
 
 import (
+	"fmt"
 	"net/url"
 	"strings"
 )
@@ -19,13 +20,40 @@ func NormalizeBaseURL(raw string) string {
 	return strings.TrimRight(raw, "/")
 }
 
-func Build(baseURL, path string, query url.Values) string {
-	baseURL = NormalizeBaseURL(baseURL)
-	parsed, err := url.Parse(baseURL)
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		baseURL = DefaultPublicBaseURL
-		parsed, _ = url.Parse(baseURL)
+// ValidateBaseURL normalizes and validates a client-visible HTTP(S) base URL.
+// A path prefix is allowed, but credentials, query parameters, and fragments
+// are not part of a stable public-link root.
+func ValidateBaseURL(raw string) (string, error) {
+	normalized := NormalizeBaseURL(raw)
+	parsed, err := url.Parse(normalized)
+	if err != nil {
+		return "", fmt.Errorf("parse URL: %w", err)
 	}
+	if parsed.Opaque != "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+		return "", fmt.Errorf("scheme must be http or https")
+	}
+	if parsed.Host == "" || parsed.Hostname() == "" {
+		return "", fmt.Errorf("host is required")
+	}
+	if parsed.User != nil {
+		return "", fmt.Errorf("credentials are not allowed")
+	}
+	if parsed.RawQuery != "" || parsed.ForceQuery {
+		return "", fmt.Errorf("query parameters are not allowed")
+	}
+	if parsed.Fragment != "" {
+		return "", fmt.Errorf("fragment is not allowed")
+	}
+	parsed.Path = strings.TrimRight(parsed.Path, "/")
+	return strings.TrimRight(parsed.String(), "/"), nil
+}
+
+func Build(baseURL, path string, query url.Values) string {
+	baseURL, err := ValidateBaseURL(baseURL)
+	if err != nil {
+		baseURL = DefaultPublicBaseURL
+	}
+	parsed, _ := url.Parse(baseURL)
 	basePath := strings.TrimRight(parsed.Path, "/")
 	path = strings.TrimLeft(path, "/")
 	if path != "" {
@@ -38,10 +66,11 @@ func Build(baseURL, path string, query url.Values) string {
 }
 
 func Host(baseURL string) string {
-	parsed, err := url.Parse(NormalizeBaseURL(baseURL))
-	if err != nil || parsed.Host == "" {
+	baseURL, err := ValidateBaseURL(baseURL)
+	if err != nil {
 		return "telesrv.net"
 	}
+	parsed, _ := url.Parse(baseURL)
 	if host := parsed.Hostname(); host != "" {
 		return host
 	}