@naviyra/cloud-panel 0.0.3-beta → 0.0.3-beta2

package/apps/panel/app/api/[...path]/route.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { cookies } from "next/headers";
 import { db } from "../../../lib/db.mjs";
 import { session, signIn } from "../../../lib/auth.mjs";
+import { originAllowed } from "../../../lib/request-origin.mjs";
 import { agent, reconcile } from "../../../lib/agent.mjs";
 import { projectInput, idSchema, MAX_ZIP_BYTES } from "@naviyra/shared";
 import {
@@ -31,7 +32,7 @@ async function handle(req, { params }) {
     const method = req.method;
     if (method !== "GET") {
       const expected = process.env.PUBLIC_ORIGIN || new URL(req.url).origin;
-      if (req.headers.get("origin") !== expected)
+      if (!originAllowed(req.headers.get("origin"), expected))
         return json({ error: "Invalid request origin" }, 403);
     }
     if (route === "auth/login" && method === "POST") {

package/apps/panel/app/globals.css

@@ -1710,26 +1710,73 @@ html[data-theme="dark"] .danger-text {
   margin-bottom: 10px;
 }
 .database-create {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: flex-end;
+  display: grid;
+  grid-template-columns: minmax(240px, 340px) minmax(220px, 1fr) auto;
+  align-items: end;
   gap: 12px 16px;
   padding: 18px 23px 20px;
 }
 .database-create label {
-  flex: 1 1 220px;
-  max-width: 460px;
   margin-bottom: 0;
+  min-width: 0;
 }
 .database-create small {
   margin-top: 4px;
+  line-height: 1.45;
 }
-.database-create input {
+.database-create input,
+.database-create select {
   height: 40px;
   margin-top: 8px;
+  box-sizing: border-box;
+}
+.database-create select {
+  display: block;
+  width: 100%;
+  padding: 0 36px 0 12px;
+  border: 1px solid #dde4e7;
+  border-radius: 6px;
+  background-color: var(--surface);
+  color: #3e5360;
+  font-size: 12px;
+  appearance: none;
+  background-image:
+    linear-gradient(45deg, transparent 50%, var(--muted) 50%),
+    linear-gradient(135deg, var(--muted) 50%, transparent 50%);
+  background-position:
+    calc(100% - 18px) center,
+    calc(100% - 13px) center;
+  background-size:
+    5px 5px,
+    5px 5px;
+  background-repeat: no-repeat;
 }
 .database-create .primary {
   height: 40px;
+  min-height: 40px;
+}
+html[data-theme="dark"] .database-create select {
+  background-color: var(--surface);
+  color: var(--ink);
+  border-color: var(--line);
+  background-image:
+    linear-gradient(45deg, transparent 50%, var(--muted) 50%),
+    linear-gradient(135deg, var(--muted) 50%, transparent 50%);
+  background-position:
+    calc(100% - 18px) center,
+    calc(100% - 13px) center;
+  background-size:
+    5px 5px,
+    5px 5px;
+  background-repeat: no-repeat;
+}
+@media (max-width: 720px) {
+  .database-create {
+    grid-template-columns: 1fr;
+  }
+  .database-create .primary {
+    justify-self: start;
+  }
 }
 .mail-address {
   display: flex;

package/apps/panel/lib/request-origin.mjs

@@ -0,0 +1,29 @@
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "::1"]);
+
+function parseOrigin(value) {
+  if (!value || typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.origin === "null") return null;
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+function hostname(url) {
+  return url.hostname.replace(/^\[|\]$/g, "");
+}
+
+function sameSite(left, right) {
+  if (left.origin === right.origin) return true;
+  if (left.protocol !== right.protocol || left.port !== right.port) return false;
+  return LOOPBACK.has(hostname(left)) && LOOPBACK.has(hostname(right));
+}
+
+export function originAllowed(originHeader, expected) {
+  const origin = parseOrigin(originHeader);
+  const target = parseOrigin(expected);
+  if (!origin || !target) return false;
+  return sameSite(origin, target);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naviyra/cloud-panel",
-  "version": "0.0.3-beta",
+  "version": "0.0.3-beta2",
   "description": "Self-hosted Naviyra panel for projects, databases, DNS, and email routing.",
   "type": "module",
   "bin": {