feat: add trusted origins configuration for auth

packages/backend/src/functions/shared/auth/index.ts

@@ -5,4 +5,9 @@ import { authOptions } from "#functions/shared/auth/options.ts"
 import env from "#functions/shared/env.ts"
 
 export const convexAuth = (ctx: GenericCtx<DataModel>) =>
-  createAuth({ ...authOptions(ctx), baseURL: env.CONVEX_SITE_URL, secret: env.AUTH_SECRET })
+  createAuth({
+    ...authOptions(ctx),
+    baseURL: env.CONVEX_SITE_URL,
+    secret: env.AUTH_SECRET,
+    trustedOrigins: env.AUTH_TRUSTED_ORIGINS,
+  })

packages/backend/src/functions/shared/auth/options.ts

@@ -33,5 +33,4 @@ export const authOptions = (ctx: GenericCtx<DataModel>) =>
       expiresIn: SESSION_EXPIRES_IN,
       updateAge: SESSION_UPDATE_AGE,
     },
-    trustedOrigins: ["init://"],
   }) satisfies AuthOptions

packages/env/src/presets.ts

@@ -18,6 +18,32 @@ export const auth = () =>
     runtimeEnv: process.env,
     server: {
       AUTH_SECRET: z.string(),
+      AUTH_TRUSTED_ORIGINS: z
+        .string()
+        .transform((value) =>
+          value
+            .split(",")
+            .map((item) => item.trim())
+            .filter(Boolean)
+        )
+        .pipe(
+          z.array(
+            z.union([
+              // Exact http/https origin (domain, localhost, or IPv4; optional port)
+              z
+                .string()
+                .regex(
+                  /^https?:\/\/(?:(?:[a-z0-9-]+\.)+[a-z0-9-]+|localhost|(?:\d{1,3}\.){3}\d{1,3})(?::\d{1,5})?$/i
+                ),
+              // HTTP/HTTPS wildcard subdomain
+              z.string().regex(/^https?:\/\/\*\.(?:[a-z0-9-]+\.)+[a-z0-9-]+(?::\d{1,5})?$/i),
+              // Protocol-agnostic wildcard subdomain
+              z.string().regex(/^\*\.(?:[a-z0-9-]+\.)+[a-z0-9-]+$/i),
+              // Custom schemes (chrome-extension, myapp, exp, etc.)
+              z.string().regex(/^(?!https?:\/\/)[a-z][a-z0-9+.-]*:\/\/[^\s]*$/i),
+            ])
+          )
+        ),
     },
     skipValidation: isCI,
   })