Omit SEO links for relative base URLs

portalOrigin fell back to the raw input when scheme or host
was missing, so paths like /fr/documents still produced
canonical and hreflang tags. Return an empty origin instead.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/complianceportal/v1/seo.go

@@ -76,10 +76,11 @@ func SEOFromRequest(r *http.Request, pageBaseURL string) (htmlLang, canonical st
 
 // portalOrigin returns scheme://host from pageBaseURL, dropping any path,
 // query, or fragment. Callers may pass a full request URL by mistake.
+// Relative or malformed values yield "" so SEO links are omitted.
 func portalOrigin(pageBaseURL string) string {
 	parsed, err := url.Parse(pageBaseURL)
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return strings.TrimRight(pageBaseURL, "/")
+		return ""
 	}
 
 	return (&url.URL{Scheme: parsed.Scheme, Host: parsed.Host}).String()

pkg/server/api/complianceportal/v1/seo_test.go

@@ -124,3 +124,22 @@ func TestSEOFromRequest_EmptyBaseURLOmitsLinks(t *testing.T) {
 	assert.Empty(t, canonical)
 	assert.Nil(t, hreflang)
 }
+
+func TestSEOFromRequest_RelativeBaseURLOmitsLinks(t *testing.T) {
+	t.Parallel()
+
+	req, err := http.NewRequest(
+		http.MethodGet,
+		"https://trust.acme.com/fr/documents",
+		nil,
+	)
+	require.NoError(t, err)
+
+	lang, canonical, hreflang := complianceportal_v1.SEOFromRequest(
+		req,
+		"/fr/documents",
+	)
+	assert.Equal(t, "fr", lang)
+	assert.Empty(t, canonical)
+	assert.Nil(t, hreflang)
+}