luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(12): IN-01 require https:// on appExternalUrl in configSchema

Browse Source 
appExternalUrl is injected as OIDC_AUTH_EXTERNAL_URL (the redirect URI
base); Authelia rejects non-https redirect URIs in production. Added
.refine() guard matching the existing oidcIssuer pattern. Added test
that verifies http:// appExternalUrl is rejected with 400.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Lucas Berger
2026-06-15 16:37:03 -04:00
co-authored by Claude Sonnet 4.6
parent 61a869ca7d
commit 22d1581484
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/setup.ts
+5 -1
View File
@@ -63,7 +63,11 @@ const configSchema = z.object({
.refine((v) => v.startsWith('https://'), { message: 'oidcIssuer must be an https URL' }), .refine((v) => v.startsWith('https://'), { message: 'oidcIssuer must be an https URL' }),
oidcClientId: z.string().min(1).max(256), oidcClientId: z.string().min(1).max(256),
vapidPublicKey: z.string().min(1).max(512), vapidPublicKey: z.string().min(1).max(512),
appExternalUrl: z.string().url().max(512), appExternalUrl: z
.string()
.url()
.max(512)
.refine((v) => v.startsWith('https://'), { message: 'appExternalUrl must be an https URL' }),
}); });
const credentialSchema = z.object({ const credentialSchema = z.object({