Address review feedback

- Remove blanket trust for the shared opengeos.org preview origin.
- Restrict Cloudflare previews to one label, HTTPS, and the default port.
- Make custom ALLOWED_ORIGINS settings authoritative over local defaults.
- Cover nested, custom-port, shared-host, and configured-origin cases.
- Document the exact default preview-origin policy and exclusions.

Author: giswqs

docs/collaboration.md

@@ -259,9 +259,11 @@ ephemeral and never written to a project file.
 > `Referer`) against `ALLOWED_ORIGINS` via `isAllowedOrigin` (defaults to the
 > hosted origins (`geolibre.app`, `web.geolibre.app`, its legacy
 > `viewer.geolibre.app` alias, `studio.geolibre.app`, and
-> `collab.geolibre.app`), the project-owned Cloudflare/GitHub Pages preview
-> origins, loopback hosts (`localhost` and `127.0.0.1`), and
-> `tauri://localhost`) as browser-origin filtering
+> `collab.geolibre.app`), single-label HTTPS deployment hosts under
+> `*.geolibre-preview.pages.dev`, loopback hosts (`localhost` and
+> `127.0.0.1`), and `tauri://localhost`). Nested or custom-port preview hosts
+> and look-alike domains are rejected; the shared `opengeos.org` GitHub Pages
+> preview origin is deliberately not trusted) as browser-origin filtering
 > and defense-in-depth (not authentication or a general server-side access gate)
 > and enforces a per-IP `checkRateLimit` (10 requests / 60 s). `Access-Control-Allow-Origin: *` is
 > still sent on responses so non-browser clients (e.g. Tauri) are not blocked by

workers/collab-node/src/server.ts

@@ -77,13 +77,18 @@ function isAllowedOrigin(
   try {
     const originUrl = new URL(originHeader);
     const host = originUrl.hostname;
-    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
-    if (
-      !envAllowed &&
-      originUrl.protocol === "https:" &&
-      (host === "opengeos.org" || host.endsWith(".geolibre-preview.pages.dev"))
-    ) {
-      return true;
+    if (!envAllowed) {
+      if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
+      const previewSuffix = ".geolibre-preview.pages.dev";
+      const previewLabel = host.endsWith(previewSuffix) ? host.slice(0, -previewSuffix.length) : "";
+      if (
+        originUrl.protocol === "https:" &&
+        !originUrl.port &&
+        previewLabel &&
+        !previewLabel.includes(".")
+      ) {
+        return true;
+      }
     }
     return allowedList.some((allowed) => {
       if (allowed === "*") return true;

workers/collab-node/test/relay.test.ts

@@ -109,7 +109,6 @@ describe("Node collaboration relay", () => {
       "https://web.geolibre.app",
       "https://viewer.geolibre.app",
       "https://studio.geolibre.app",
-      "https://opengeos.org",
       "https://50e58010.geolibre-preview.pages.dev",
     ]) {
       const response = await fetch(`${http}/sessions`, {
@@ -130,6 +129,42 @@ describe("Node collaboration relay", () => {
       headers: { origin: "https://preview.geolibre-preview.pages.dev.example.com" },
     });
     assert.equal(rejectedPreviewLookalike.status, 403);
+
+    for (const origin of [
+      "https://opengeos.org",
+      "https://a.b.geolibre-preview.pages.dev",
+      "https://preview.geolibre-preview.pages.dev:8443",
+    ]) {
+      const response = await fetch(`${http}/sessions`, {
+        method: "POST",
+        headers: { origin },
+      });
+      assert.equal(response.status, 403, `${origin} should be rejected`);
+    }
+  });
+
+  it("makes a configured origin allowlist authoritative", async () => {
+    const { http } = await start();
+    const previous = process.env.ALLOWED_ORIGINS;
+    process.env.ALLOWED_ORIGINS = "https://allowed.example";
+    try {
+      const allowed = await fetch(`${http}/sessions`, {
+        method: "POST",
+        headers: { origin: "https://allowed.example" },
+      });
+      assert.equal(allowed.status, 200);
+
+      for (const origin of ["http://localhost:5173", "https://pr-1.geolibre-preview.pages.dev"]) {
+        const response = await fetch(`${http}/sessions`, {
+          method: "POST",
+          headers: { origin },
+        });
+        assert.equal(response.status, 403, `${origin} should require explicit configuration`);
+      }
+    } finally {
+      if (previous === undefined) delete process.env.ALLOWED_ORIGINS;
+      else process.env.ALLOWED_ORIGINS = previous;
+    }
   });
 
   it("rejects an oversized session-create body by declared length and by count", async () => {

workers/collab/src/index.ts

@@ -63,13 +63,18 @@ function isAllowedOrigin(originHeader: string | null, envAllowed?: string): bool
   try {
     const originUrl = new URL(originHeader);
     const host = originUrl.hostname;
-    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
-    if (
-      !envAllowed &&
-      originUrl.protocol === "https:" &&
-      (host === "opengeos.org" || host.endsWith(".geolibre-preview.pages.dev"))
-    ) {
-      return true;
+    if (!envAllowed) {
+      if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".localhost")) return true;
+      const previewSuffix = ".geolibre-preview.pages.dev";
+      const previewLabel = host.endsWith(previewSuffix) ? host.slice(0, -previewSuffix.length) : "";
+      if (
+        originUrl.protocol === "https:" &&
+        !originUrl.port &&
+        previewLabel &&
+        !previewLabel.includes(".")
+      ) {
+        return true;
+      }
     }
     return allowedList.some((allowed) => {
       if (allowed === "*") return true;