rubyforgood · awwaiid · Sep 13, 2026
diff --git a/.env.example b/.env.example
@@ -10,3 +10,15 @@ RECAPTCHA_PRIVATE_KEY=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
 # [OPTIONAL] - Used to fetch copies of production DB
 AZURE_STORAGE_ACCOUNT_NAME=
 AZURE_STORAGE_ACCESS_KEY=
+
+# [OPTIONAL] - Canonical host for this deployment. Only affects links generated
+# outside of a request (mailers, jobs, rake tasks); in-request links already
+# follow whichever domain the visitor arrived on.
+APP_HOST=
+# [OPTIONAL] - HELO domain used for the SMTP conversation (tied to where mail is
+# sent from / SPF / DKIM, not to which domain the site is browsed on)
+SMTP_DOMAIN=
+# [OPTIONAL] - Used only where we deliberately link to a *different* deployment
+# (the staging banner pointing at the live site, demo credentials in email)
+PRODUCTION_URL=
+DEMO_URL=
diff --git a/app/controllers/distributions_controller.rb b/app/controllers/distributions_controller.rb
@@ -259,7 +259,8 @@ def calendar
     crypt = ActiveSupport::MessageEncryptor.new(Rails.application.secret_key_base[0..31])
     organization_id = crypt.decrypt_and_verify(CGI.unescape(params[:hash]))
 
-    render body: CalendarService.calendar(organization_id), content_type: Mime::Type.lookup("text/calendar")
+    calendar = CalendarService.calendar(organization_id, host: request.host_with_port, protocol: request.protocol)
+    render body: calendar, content_type: Mime::Type.lookup("text/calendar")
   rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveSupport::MessageEncryptor::InvalidMessage
     head :unauthorized
   end

diff --git a/app/helpers/site_urls_helper.rb b/app/helpers/site_urls_helper.rb
@@ -0,0 +1,27 @@
+# Builds links to a *different* Human Essentials deployment than the one
+# currently serving the request. Anything pointing at the current deployment
+# should use ordinary route helpers instead, so it follows whichever domain the
+# visitor arrived on. See config/initializers/site_urls.rb.
+module SiteUrlsHelper
+  def production_url(path = "/")
+    site_url(site_urls.production, path)
+  end
+
+  def demo_url(path = "/")
+    site_url(site_urls.demo, path)
+  end
+
+  def production_host
+    URI.parse(site_urls.production).host
+  end
+
+  private
+
+  def site_urls
+    Rails.application.config.x.site_urls
+  end
+
+  def site_url(base, path)
+    URI.join(base, path).to_s
+  end
+end
diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb
@@ -2,4 +2,5 @@
 class ApplicationMailer < ActionMailer::Base
   default from: "Please do not reply to this email as this mail box is not monitored — Human Essentials <no-reply@humanessentials.app>"
   layout "mailer"
+  helper SiteUrlsHelper
 end
diff --git a/app/services/calendar_service.rb b/app/services/calendar_service.rb
@@ -4,8 +4,10 @@
 module CalendarService
   # Prints out a calendar in ICS format for use e.g. in adding to Google Calendar.
   # @param organization_id [Integer]
+  # @param url_options [Hash] host/protocol to build event links with, so the
+  #   calendar points back at the domain the subscriber is using.
   # @return [String]
-  def self.calendar(organization_id)
+  def self.calendar(organization_id, url_options = {})
     distributions = Organization.find(organization_id)
       .distributions
       .includes(:storage_location, :partner)
@@ -27,7 +29,7 @@ def self.calendar(organization_id)
         e.dtend = Icalendar::Values::DateTime.new(dist.issued_at + 15.minutes, "tzid" => tz_id)
         e.summary = "Pickup from #{dist.partner.name}"
         e.location = dist.storage_location.address
-        e.url = "https://humanessentials.app/diaper_bank/distributions/schedule"
+        e.url = Rails.application.routes.url_helpers.schedule_distributions_url(**url_options)
       end
     end
     cal.publish

diff --git a/app/views/account_request_mailer/confirmation.html.erb b/app/views/account_request_mailer/confirmation.html.erb
@@ -23,7 +23,7 @@
 </p>
 
 <p>
-  <a href='https://staging.humanessentials.app/users/sign_in'>Human Essentials</a>
+  <%= link_to 'Human Essentials', demo_url('/users/sign_in') %>
 </p>
 <p>
   <strong> Bank user login: </strong>
@@ -43,7 +43,7 @@
 
 <p>
   A couple things to know about the sandbox servers before you start using them:
-      The development team uses the servers for testing our new features and upgrades before putting them on the live site to ensure that no bugs get pushed through to the live site, so if something looks different than the (real) humanessentials.app site that is probably why! Please don’t enter any sensitive information into the demo servers, several users have access to the demo servers and it will be visible to all users.
+      The development team uses the servers for testing our new features and upgrades before putting them on the live site to ensure that no bugs get pushed through to the live site, so if something looks different than the (real) <%= production_host %> site that is probably why! Please don’t enter any sensitive information into the demo servers, several users have access to the demo servers and it will be visible to all users.
 </p>
 
 <p>

diff --git a/app/views/account_request_mailer/confirmation.text.erb b/app/views/account_request_mailer/confirmation.text.erb
@@ -13,7 +13,7 @@ If you'd like to experience the app before continuing, please log in to the sand
 ***The details below allow you to log into a demo site. All data on the demo site is reset every day at 6 AM EST.***
 
 Human Essentials:
-Link: https://staging.humanessentials.app/users/sign_in
+Link: <%= demo_url('/users/sign_in') %>
 
 Bank user login:
 Username: org_admin1@example.com
@@ -24,7 +24,7 @@ Username: verified@example.com
 Password: password!
 
 A couple things to know about the sandbox servers before you start using them:
-  The development team uses the servers for testing our new features and upgrades before putting them on the live site to ensure that no bugs get pushed through to the live site, so if something looks different than the (real) humanessentials.app site that is probably why! Please don’t enter any sensitive information into the demo servers, several users have access to the demo servers and it will be visible to all users.
+  The development team uses the servers for testing our new features and upgrades before putting them on the live site to ensure that no bugs get pushed through to the live site, so if something looks different than the (real) <%= production_host %> site that is probably why! Please don’t enter any sensitive information into the demo servers, several users have access to the demo servers and it will be visible to all users.
 
 Finally, we made a series of getting started videos with detailed directions on setting up your essentials bank in Human Essentials.   These are not being kept up-to-date,
 but might still be useful if you prefer video to the User Guide.

diff --git a/app/views/account_requests/new.html.erb b/app/views/account_requests/new.html.erb
@@ -26,7 +26,7 @@
       </style>
 
       <div class='card-text' id='partner_info'>
-        <p class='p-2'>Are you a current partner to diaper and/or period supply banks? If so please go <a href='https://humanessentials.app/users/sign_in'>here</a> to login.</p>
+        <p class='p-2'>Are you a current partner to diaper and/or period supply banks? If so please go <%= link_to 'here', new_user_session_path %> to login.</p>
         <p class='p-2'>If you are wishing to receive diapers/period supplies and partner to a local diaper/period supply bank please contact your local bank. They are the only ones able create your account.</p>
         <p class='p-2'>If you are looking for an essentials bank that distributes diapers, please refer to the <a href='https://nationaldiaperbanknetwork.org/member-directory/'>NDBN member directory</a>. If you are, instead, looking for an essentials bank that deals in period supplies, please refer to the <a href='https://allianceforperiodsupplies.org/allied-programs/'>Alliance for Period Supplies directory</a>.</p>
       </div>
@@ -90,7 +90,7 @@
 
       <div class='card-text'>
         <p> Hey there, it looks like you're trying to request an account, but you're not currently on the live version of Human Essentials </p>
-        <p> To request an account, <%= link_to 'click here', 'https://humanessentials.app/account_requests/new' %> to head on over to the Human Essentials website</p>
+        <p> To request an account, <%= link_to 'click here', production_url('/account_requests/new') %> to head on over to the Human Essentials website</p>
       </div>
     </div>
   </div>

diff --git a/app/views/distribution_mailer/partner_mailer.html.erb b/app/views/distribution_mailer/partner_mailer.html.erb
@@ -355,7 +355,7 @@
             <table role="presentation" border="0" cellpadding="0" cellspacing="0">
               <tr>
                 <td class="content-block">
-                <span class="apple-link">This email was sent with ❤ by <a href="https://humanessentials.app">Human Essentials</a>.️</span>
+                <span class="apple-link">This email was sent with ❤ by <%= link_to "Human Essentials", root_url %>.️</span>
                 </td>
               </tr>
               <tr>

diff --git a/app/views/layouts/_devise_shared.html.erb b/app/views/layouts/_devise_shared.html.erb
@@ -81,10 +81,10 @@
             <h3 class="modal-title" id="warningModalLabel"><b>This site is for TEST purposes only!</b></h3>
           </div>
           <div class="modal-body">
-            You're visiting staging.humanessentials.app, a demo/test site for the full site at <a href="https://humanessentials.app">humanessentials.app</a>.<br>
+            You're visiting <%= request.host %>, a demo/test site for the full site at <%= link_to production_host, production_url %>.<br>
             It is not safe to upload, enter or save any sensitive data here.<br>
             <div class="modal-body-warning-text">
-              If you meant to login to your live account, go to <a href="https://humanessentials.app/users/sign_in">humanessentials.app</a>
+              If you meant to login to your live account, go to <%= link_to production_host, production_url('/users/sign_in') %>
             </div>
             <br>
             <div class="form-check">

diff --git a/app/views/reminder_deadline_mailer/notify_deadline.html.erb b/app/views/reminder_deadline_mailer/notify_deadline.html.erb
@@ -2,7 +2,7 @@
     <p>
     This is a friendly reminder that <%= @organization.name %> requires your human essentials requests to be submitted by <%= @deadline.strftime('%a, %d %b %Y') %>
 if you would like to receive a distribution next month.</p>
-    <p>Please log into <a href="https://humanessentials.app">Human Essentials</a>
+    <p>Please log into <%= link_to "Human Essentials", root_url %>
 before this date and submit your request if you are intending to submit an essentials request.</p>
     <p>Please contact <%= @organization.name %> at <%= @organization.email %>
 if you have any questions about this!</p>

diff --git a/app/views/user_mailer/role_added.html.erb b/app/views/user_mailer/role_added.html.erb
@@ -7,4 +7,4 @@
 <% end %>
 </ul>
 
-<p>Please log into <a href="https://humanessentials.app">Human Essentials</a> to view your new role!</p>
+<p>Please log into <%= link_to "Human Essentials", root_url %> to view your new role!</p>
diff --git a/app/views/user_mailer/role_added.text.erb b/app/views/user_mailer/role_added.text.erb
@@ -6,4 +6,4 @@ This is a notification that you have been given the following roles in the Human
 * <%= role.name.titleize %> for <%= @resource.name %></li>
 <% end %>
 
-Please log into https://humanessentials.app to view your new role!
+Please log into <%= root_url %> to view your new role!
diff --git a/app/views/users/mailer/invitation_instructions.html.erb b/app/views/users/mailer/invitation_instructions.html.erb
@@ -390,7 +390,7 @@
           <table role="presentation" border="0" cellpadding="0" cellspacing="0">
             <tr>
               <td class="content-block">
-                <span class="apple-link">This email was sent with ❤ by <a href="https://humanessentials.app">Human Essentials</a>.️</span>
+                <span class="apple-link">This email was sent with ❤ by <%= link_to "Human Essentials", root_url %>.️</span>
               </td>
             </tr>
             <tr>

diff --git a/app/views/users/mailer/reset_password_instructions.html.erb b/app/views/users/mailer/reset_password_instructions.html.erb
@@ -11,6 +11,6 @@
 <p>If you didn't request this, please ignore this email.</p>
 <p>Your password won't change until you access the link above and create a new one.</p>
 <p style="font-size:16px;">
-<img src="<%= asset_url ("https://humanessentials.app/img/he-ruby-logo.png") %>" style="float:left;max-height:32px">
+<img src="<%= asset_url("/img/he-ruby-logo.png") %>" style="float:left;max-height:32px">
 <span style="padding-top:4px; display:inline-block;"> &nbsp; Human Essentials Team </span>
 </p>
diff --git a/app/views/users/passwords/new.html.erb b/app/views/users/passwords/new.html.erb
@@ -43,7 +43,7 @@
         <h3 class="modal-title" id="exampleModalLabel">Demo Site Reminder</h3>
       </div>
       <div class="modal-body">
-        Please be aware that staging.humanessentials.app is a demo/test server for <a href="https://humanessentials.app">humanessentials.app</a>.
+        Please be aware that <%= request.host %> is a demo/test server for <%= link_to production_host, production_url %>.
         Multiple people have access to the test accounts so please do not save or upload any sensitive data.
       </div>
       <div class="modal-footer">

diff --git a/config/environments/development.rb b/config/environments/development.rb
@@ -35,6 +35,7 @@
   # Show full error reports.
   config.consider_all_requests_local = true
   config.action_mailer.default_url_options = { host: "localhost:3000" }
+  config.action_mailer.asset_host = "http://localhost:3000"
 
   # Enable/disable caching. By default caching is disabled.
   if Rails.root.join("tmp/caching-dev.txt").exist?

diff --git a/config/environments/production.rb b/config/environments/production.rb
@@ -12,16 +12,26 @@
   # Rake tasks automatically ignore this option for performance.
   config.eager_load = true
 
-  routes.default_url_options[:host] = 'humanessentials.app'
-  config.action_mailer.default_url_options = { host: "humanessentials.app" }
+  # The app is served on several domains (humanessentials.app,
+  # humanessentialsapp.com, humanessentialsapp.org). Links generated during a
+  # request already follow the domain the visitor arrived on -- the request host
+  # takes precedence over routes.default_url_options -- so this only sets the
+  # fallback used outside of a request (mailers, jobs, rake tasks).
+  app_host = ENV.fetch('APP_HOST', 'humanessentials.app')
+
+  routes.default_url_options[:host] = app_host
+  config.action_mailer.default_url_options = { host: app_host }
+  config.action_mailer.asset_host = "https://#{app_host}"
   config.action_mailer.delivery_method = :smtp
   config.action_mailer.smtp_settings = {
     address: ENV['SMTP_SERVER'],
     port: '587',
     authentication: :plain,
     user_name: ENV['SMTP_USERNAME'],
     password: ENV['SMTP_PASSWORD'],
-    domain: 'humanessentials.app',
+    # HELO domain for the SMTP conversation -- tied to where mail is sent from
+    # (SPF/DKIM), not to which domain the site is being browsed on.
+    domain: ENV.fetch('SMTP_DOMAIN', 'humanessentials.app'),
     enable_starttls_auto: true
   }
 

diff --git a/config/environments/staging.rb b/config/environments/staging.rb
@@ -12,7 +12,11 @@
   # Rake tasks automatically ignore this option for performance.
   config.eager_load = true
 
-  config.action_mailer.default_url_options = { host: "staging.humanessentials.app" }
+  app_host = ENV.fetch('APP_HOST', 'staging.humanessentials.app')
+
+  routes.default_url_options[:host] = app_host
+  config.action_mailer.default_url_options = { host: app_host }
+  config.action_mailer.asset_host = "https://#{app_host}"
   config.action_mailer.delivery_method = :smtp
   config.action_mailer.smtp_settings = {
     user_name: ENV['MAILTRAP_USERNAME'],

diff --git a/config/environments/test.rb b/config/environments/test.rb
@@ -19,6 +19,7 @@
   config.eager_load = ENV["CI"] == "true"
 
   config.action_mailer.default_url_options = { host: "localhost" }
+  config.action_mailer.asset_host = "http://localhost"
 
   # Configure public file server for tests with Cache-Control for performance.
   config.public_file_server.enabled = true

diff --git a/config/initializers/site_urls.rb b/config/initializers/site_urls.rb
@@ -0,0 +1,11 @@
+# Human Essentials is reachable on several domains (humanessentials.app,
+# humanessentialsapp.com, humanessentialsapp.org) because some networks block
+# the `.app` TLD. Links rendered during a request are generated from the host
+# the visitor actually arrived on, so nothing here is needed for those.
+#
+# These settings cover the handful of places where we deliberately link to a
+# *different* deployment than the one serving the page -- the staging banner
+# pointing people at the live site, and the account request email pointing at
+# the demo site. Override them per-deployment if the canonical domain changes.
+Rails.application.config.x.site_urls.production = ENV.fetch("PRODUCTION_URL", "https://humanessentials.app")
+Rails.application.config.x.site_urls.demo = ENV.fetch("DEMO_URL", "https://staging.humanessentials.app")
diff --git a/spec/helpers/site_urls_helper_spec.rb b/spec/helpers/site_urls_helper_spec.rb
@@ -0,0 +1,21 @@
+RSpec.describe SiteUrlsHelper, type: :helper do
+  describe "#production_url" do
+    it "defaults to the configured live site" do
+      expect(helper.production_url).to eq("https://humanessentials.app/")
+      expect(helper.production_url("/users/sign_in")).to eq("https://humanessentials.app/users/sign_in")
+    end
+
+    it "follows the configured host when the live site moves to another domain" do
+      allow(Rails.application.config.x.site_urls).to receive(:production).and_return("https://humanessentialsapp.org")
+
+      expect(helper.production_url("/users/sign_in")).to eq("https://humanessentialsapp.org/users/sign_in")
+      expect(helper.production_host).to eq("humanessentialsapp.org")
+    end
+  end
+
+  describe "#demo_url" do
+    it "defaults to the configured demo site" do
+      expect(helper.demo_url("/users/sign_in")).to eq("https://staging.humanessentials.app/users/sign_in")
+    end
+  end
+end
diff --git a/spec/mailers/account_request_mailer_spec.rb b/spec/mailers/account_request_mailer_spec.rb
@@ -27,7 +27,7 @@
     context 'HTML format' do
       it 'should include the staging/demo account information' do
         html = html_body(mail)
-        expect(html).to match(%r{<a href='https://staging.humanessentials.app/users/sign_in'>Human Essentials</a>})
+        expect(html).to match(%r{<a href="https://staging.humanessentials.app/users/sign_in">Human Essentials</a>})
         expect(html).to match('Username: org_admin1@example.com')
         expect(html).to match('Password: password!')
 

diff --git a/spec/requests/distributions_requests_spec.rb b/spec/requests/distributions_requests_spec.rb
@@ -1049,7 +1049,8 @@
       context 'with a correct hash id' do
         it 'should render the calendar' do
           get calendar_distributions_path(hash: hashed_id)
-          expect(CalendarService).to have_received(:calendar).with(organization.id)
+          expect(CalendarService).to have_received(:calendar)
+            .with(organization.id, host: "www.example.com", protocol: "http://")
           expect(response.media_type).to include('text/calendar')
           expect(response.body).to eq('SOME ICS STRING')
         end

diff --git a/spec/services/calendar_service_spec.rb b/spec/services/calendar_service_spec.rb
@@ -17,7 +17,7 @@
           partner: partner2, storage_location: storage_location)
         create(:distribution, issued_at: time_zone.local(2022, 3, 17),
           partner: partner2, storage_location: storage_location)
-        result = described_class.calendar(organization.id)
+        result = described_class.calendar(organization.id, host: "humanessentials.app", protocol: "https")
         expected = <<~ICAL
           BEGIN:VCALENDAR
           VERSION:2.0
@@ -46,24 +46,21 @@
           DTEND;TZID=America/New_York:20220317T071500
           LOCATION:1500 Remount Road\\, Front Royal\\, VA 22630
           SUMMARY:Pickup from Partner 1
-          URL;VALUE=URI:https://humanessentials.app/diaper_bank/distributions/schedul
-           e
+          URL;VALUE=URI:https://humanessentials.app/distributions/schedule
           END:VEVENT
           BEGIN:VEVENT
           DTSTART;TZID=America/New_York:20220217T060000
           DTEND;TZID=America/New_York:20220217T061500
           LOCATION:1500 Remount Road\\, Front Royal\\, VA 22630
           SUMMARY:Pickup from Partner 1
-          URL;VALUE=URI:https://humanessentials.app/diaper_bank/distributions/schedul
-           e
+          URL;VALUE=URI:https://humanessentials.app/distributions/schedule
           END:VEVENT
           BEGIN:VEVENT
           DTSTART;TZID=America/New_York:20220316T210000
           DTEND;TZID=America/New_York:20220316T211500
           LOCATION:1500 Remount Road\\, Front Royal\\, VA 22630
           SUMMARY:Pickup from Partner 2
-          URL;VALUE=URI:https://humanessentials.app/diaper_bank/distributions/schedul
-           e
+          URL;VALUE=URI:https://humanessentials.app/distributions/schedule
           END:VEVENT
           END:VCALENDAR
         ICAL
@@ -72,6 +69,17 @@
         expect(result).to eq(expected.gsub("\n", "\r\n"))
       end
     end
+
+    it "builds event links for whichever domain the subscriber is using" do
+      storage_location = create(:storage_location, time_zone: "America/New_York", organization: organization)
+      partner = create(:partner, organization: organization)
+      create(:distribution, issued_at: 1.day.ago, partner: partner, storage_location: storage_location)
+
+      result = described_class.calendar(organization.id, host: "humanessentialsapp.org", protocol: "https")
+
+      expect(result).to include("https://humanessentialsapp.org/distributions/schedule")
+      expect(result).not_to include("humanessentials.app")
+    end
   end
 
   specify "#time_zones" do

diff --git a/spec/system/account_request_system_spec.rb b/spec/system/account_request_system_spec.rb
@@ -79,7 +79,7 @@
 
         choose(option: 'partner')
 
-        expect(page).to have_link('here', href: 'https://humanessentials.app/users/sign_in')
+        expect(page).to have_link('here', href: new_user_session_path)
       end
     end
-Original file line number
+Diff line change
@@ Expand Up / @@ -79,7 +79,7 @@ @@
             choose(option: 'partner')
-            expect(page).to have_link('here', href: 'https://humanessentials.app/users/sign_in')
+            expect(page).to have_link('here', href: new_user_session_path)
           end
         end
@@ Expand Down @@