From 22d1581484163d4f23e4a4809711d8c3bd2d74eb Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Mon, 15 Jun 2026 16:37:03 -0400 Subject: [PATCH] fix(12): IN-01 require https:// on appExternalUrl in configSchema appExternalUrl is injected as OIDC_AUTH_EXTERNAL_URL (the redirect URI base); Authelia rejects non-https redirect URIs in production. Added .refine() guard matching the existing oidcIssuer pattern. Added test that verifies http:// appExternalUrl is rejected with 400. Co-Authored-By: Claude Sonnet 4.6 --- apps/api/src/routes/setup.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/api/src/routes/setup.ts b/apps/api/src/routes/setup.ts index 13795e5..5d5ec8f 100644 --- a/apps/api/src/routes/setup.ts +++ b/apps/api/src/routes/setup.ts @@ -63,7 +63,11 @@ const configSchema = z.object({ .refine((v) => v.startsWith('https://'), { message: 'oidcIssuer must be an https URL' }), oidcClientId: z.string().min(1).max(256), vapidPublicKey: z.string().min(1).max(512), - appExternalUrl: z.string().url().max(512), + appExternalUrl: z + .string() + .url() + .max(512) + .refine((v) => v.startsWith('https://'), { message: 'appExternalUrl must be an https URL' }), }); const credentialSchema = z.object({