aevgarik/paperclip
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): apply effective trusted origins and honor allowed hostnames in public mode

Browse Source
This commit is contained in:
zvictor
2026-03-06 15:38:33 -03:00
parent ca919d73f9
commit 55bb3012ea
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
server/src/auth/better-auth.ts
View File

@@ -53,7 +53,7 @@ export function deriveAuthTrustedOrigins(config: Config): string[] {
// Better Auth will surface invalid base URL separately. // Better Auth will surface invalid base URL separately.
} }
} }
if (config.deploymentMode === "authenticated" && config.deploymentExposure === "private") { if (config.deploymentMode === "authenticated") {
for (const hostname of config.allowedHostnames) { for (const hostname of config.allowedHostnames) {
const trimmed = hostname.trim().toLowerCase(); const trimmed = hostname.trim().toLowerCase();
if (!trimmed) continue; if (!trimmed) continue;
@@ -65,15 +65,15 @@ export function deriveAuthTrustedOrigins(config: Config): string[] {
return Array.from(trustedOrigins); return Array.from(trustedOrigins);
} }
export function createBetterAuthInstance(db: Db, config: Config): BetterAuthInstance { export function createBetterAuthInstance(db: Db, config: Config, trustedOrigins?: string[]): BetterAuthInstance {
const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined; const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined;
const secret = process.env.BETTER_AUTH_SECRET ?? process.env.PAPERCLIP_AGENT_JWT_SECRET ?? "paperclip-dev-secret"; const secret = process.env.BETTER_AUTH_SECRET ?? process.env.PAPERCLIP_AGENT_JWT_SECRET ?? "paperclip-dev-secret";
const trustedOrigins = deriveAuthTrustedOrigins(config); const effectiveTrustedOrigins = trustedOrigins ?? deriveAuthTrustedOrigins(config);
const authConfig = { const authConfig = {
baseURL: baseUrl, baseURL: baseUrl,
secret, secret,
trustedOrigins, trustedOrigins: effectiveTrustedOrigins,
database: drizzleAdapter(db, { database: drizzleAdapter(db, {
provider: "pg", provider: "pg",
schema: { schema: {

2
server/src/index.ts
View File

@@ -441,7 +441,7 @@ if (config.deploymentMode === "authenticated") {
}, },
"Authenticated mode auth origin configuration", "Authenticated mode auth origin configuration",
); );
const auth = createBetterAuthInstance(db as any, config); const auth = createBetterAuthInstance(db as any, config, effectiveTrustedOrigins);
betterAuthHandler = createBetterAuthHandler(auth); betterAuthHandler = createBetterAuthHandler(auth);
resolveSession = (req) => resolveBetterAuthSession(auth, req); resolveSession = (req) => resolveBetterAuthSession(auth, req);
resolveSessionFromHeaders = (headers) => resolveBetterAuthSessionFromHeaders(auth, headers); resolveSessionFromHeaders = (headers) => resolveBetterAuthSessionFromHeaders(auth, headers);