현재 작업 상태 저장

apps/api/app/routes/auth.py

@@ -221,9 +221,40 @@ def _is_local_origin(origin: str) -> bool:
     return host in {"localhost", "127.0.0.1", "::1"}
 
 
+def _frontend_origin_map() -> dict[str, str]:
+    mapped: dict[str, str] = {}
+    for api_host, frontend_origin in settings.frontend_origin_map.items():
+        host = (api_host or "").strip().lower().rstrip(".")
+        origin = _url_origin(frontend_origin)
+        if host and origin:
+            mapped[host] = origin
+    return mapped
+
+
+def _dev_login_extra_origins() -> set[str]:
+    return {
+        origin
+        for value in settings.auth_dev_login_extra_origins
+        if (origin := _url_origin(value))
+    }
+
+
+def _dev_login_extra_hosts() -> set[str]:
+    return {
+        host
+        for origin in _dev_login_extra_origins()
+        if (host := (urlsplit(origin).hostname or "").lower())
+    }
+
+
+def _is_dev_login_allowed_origin(origin: str) -> bool:
+    host = (urlsplit(origin).hostname or "").lower()
+    return _is_local_origin(origin) or origin in _dev_login_extra_origins() or host in _dev_login_extra_hosts()
+
+
 def _configured_frontend_origins() -> list[str]:
     origins: list[str] = []
-    for value in [settings.frontend_base_url, *settings.cors_origins]:
+    for value in [settings.frontend_base_url, *settings.frontend_origin_map.values(), *settings.cors_origins]:
         origin = _url_origin(value)
         if origin and origin not in origins:
             origins.append(origin)
@@ -243,8 +274,8 @@ def _frontend_origin_for_request(request: Request | None = None) -> str:
         forwarded_host = request.headers.get("x-forwarded-host")
         host = (forwarded_host or request.headers.get("host") or "").split(",", 1)[0].strip()
         hostname = host.rsplit(":", 1)[0].lower() if host else ""
-        if hostname == "api-vignette.chanpaca.net":
-            return "https://vignette.chanpaca.net"
+        if mapped_origin := _frontend_origin_map().get(hostname):
+            return mapped_origin
         if hostname in {"localhost", "127.0.0.1", "::1"}:
             return fallback
 
@@ -348,15 +379,24 @@ def _dev_login_available(request: Request) -> bool:
     if settings.environment != "dev" or not settings.auth_dev_login_enabled:
         return False
 
+    if _dev_login_extra_origins():
+        return True
+
+    saw_browser_origin = False
     for header_name in ("origin", "referer"):
         origin = _url_origin(request.headers.get(header_name))
-        if origin and not _is_local_origin(origin):
-            return False
+        if origin:
+            saw_browser_origin = True
+            if not _is_dev_login_allowed_origin(origin):
+                return False
+
+    if not saw_browser_origin and _dev_login_extra_origins():
+        return True
 
     forwarded_host = request.headers.get("x-forwarded-host")
     host = (forwarded_host or request.headers.get("host") or "").split(",", 1)[0].strip()
     origin = _url_origin(f"http://{host}") if host else None
-    return bool(origin and _is_local_origin(origin))
+    return bool(origin and _is_dev_login_allowed_origin(origin))
 
 
 @router.get("/config", response_model=AuthConfigResponse)