Qiusheng Wu 5ce4d686c6 fix(collab): allow hosted app origins (#2011) ...

* fix(collab): allow hosted app origins

The production web and studio hosts were missing from the relay defaults, causing session creation to fail with HTTP 403. Keep both relay implementations aligned and cover the hosted origins with a regression test.

* fix(collab): allow deployment preview origins

PR previews run on the project-owned Cloudflare Pages hostname and opengeos.org, so the production relay must accept those origins too. Keep custom operator allowlists authoritative and reject look-alike preview domains.

* Address CodeRabbit review feedback

- Document every default collaboration origin category so the operator note matches the relay policy.

* Address review feedback

- Remove blanket trust for the shared opengeos.org preview origin.
- Restrict Cloudflare previews to one label, HTTPS, and the default port.
- Make custom ALLOWED_ORIGINS settings authoritative over local defaults.
- Cover nested, custom-port, shared-host, and configured-origin cases.
- Document the exact default preview-origin policy and exclusions.

2026-08-19 23:29:42 -04:00

..

relay.test.ts

fix(collab): allow hosted app origins (#2011)

2026-08-19 23:29:42 -04:00