fix(collab): allow hosted app origins

docs/collaboration.md

@@ -257,7 +257,9 @@ ephemeral and never written to a project file.
 
 > **Operator note:** `POST /sessions` validates the request `Origin` (or
 > `Referer`) against `ALLOWED_ORIGINS` via `isAllowedOrigin` (defaults to the
-> app's own domains plus `localhost` for development) as browser-origin filtering
+> hosted app origins (`geolibre.app`, `web.geolibre.app`, its legacy
+> `viewer.geolibre.app` alias, and `studio.geolibre.app`) plus `localhost` for
+> development) as browser-origin filtering
 > and defense-in-depth (not authentication or a general server-side access gate)
 > and enforces a per-IP `checkRateLimit` (10 requests / 60 s). `Access-Control-Allow-Origin: *` is
 > still sent on responses so non-browser clients (e.g. Tauri) are not blocked by

workers/collab-node/src/server.ts

@@ -65,6 +65,9 @@ function isAllowedOrigin(
         .filter(Boolean)
     : [
         "https://geolibre.app",
+        "https://web.geolibre.app",
+        "https://viewer.geolibre.app",
+        "https://studio.geolibre.app",
         "https://collab.geolibre.app",
         "http://localhost",
         "http://127.0.0.1",

workers/collab-node/test/relay.test.ts

@@ -101,6 +101,29 @@ describe("Node collaboration relay", () => {
     await assert.rejects(connect(http, "NOTFOUND"), /Unexpected server response: 404/);
   });
 
+  it("allows the hosted GeoLibre web origins to create sessions", async () => {
+    const { http } = await start();
+
+    for (const origin of [
+      "https://geolibre.app",
+      "https://web.geolibre.app",
+      "https://viewer.geolibre.app",
+      "https://studio.geolibre.app",
+    ]) {
+      const response = await fetch(`${http}/sessions`, {
+        method: "POST",
+        headers: { origin },
+      });
+      assert.equal(response.status, 200, `${origin} should be allowed`);
+    }
+
+    const rejected = await fetch(`${http}/sessions`, {
+      method: "POST",
+      headers: { origin: "https://web.geolibre.app.example.com" },
+    });
+    assert.equal(rejected.status, 403);
+  });
+
   it("rejects an oversized session-create body by declared length and by count", async () => {
     const { http } = await start();
 

workers/collab/src/index.ts

@@ -51,6 +51,9 @@ function isAllowedOrigin(originHeader: string | null, envAllowed?: string): bool
         .filter(Boolean)
     : [
         "https://geolibre.app",
+        "https://web.geolibre.app",
+        "https://viewer.geolibre.app",
+        "https://studio.geolibre.app",
         "https://collab.geolibre.app",
         "http://localhost",
         "http://127.0.0.1",