@podosoft/podokit 1.5.0 → 1.6.1

package/dist/templates/fullstack/apps/api/src/database/migration-files.spec.ts

@@ -0,0 +1,116 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import type { MigrationInterface } from "typeorm";
+import {
+  assertMigrationsLoaded,
+  loadMigrations,
+  MIGRATION_LIST,
+  migrationPaths,
+  migrationSet,
+} from "./migration-files";
+
+const roots: string[] = [];
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function apiRoot(files: Record<string, string>): string {
+  const root = mkdtempSync(join(tmpdir(), "migration-files-"));
+  roots.push(root);
+  for (const [path, content] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), content);
+  }
+  return root;
+}
+
+const migrationSource = (name: string): string =>
+  `export class ${name} { name = "${name}"; async up() {} async down() {} }\n`;
+
+const loaded = (...names: string[]): MigrationInterface[] =>
+  names.map((name) => ({ name, up: async () => undefined, down: async () => undefined }));
+
+describe("migration files", () => {
+  it("lists source migrations in timestamp order outside production", () => {
+    const root = apiRoot({
+      "src/migrations/1700000000002-Second.ts": migrationSource("Second1700000000002"),
+      "src/migrations/1700000000001-First.ts": migrationSource("First1700000000001"),
+      "src/migrations/helpers.ts": "export {};\n",
+      "dist/migrations/1690000000000-Stale.js": migrationSource("Stale1690000000000"),
+    });
+    const set = migrationSet({ root, production: false });
+    expect(set).toEqual({
+      directory: join(root, "src/migrations"),
+      compiled: false,
+      files: [{ file: "1700000000001-First.ts" }, { file: "1700000000002-Second.ts" }],
+    });
+    expect(migrationPaths(set)).toEqual([
+      join(root, "src/migrations/1700000000001-First.ts"),
+      join(root, "src/migrations/1700000000002-Second.ts"),
+    ]);
+  });
+
+  it("reads the build's list in production", () => {
+    const list = [{ file: "1700000000001-First.js", name: "First1700000000001" }];
+    const root = apiRoot({
+      [`dist/migrations/${MIGRATION_LIST}`]: JSON.stringify(list),
+      "dist/migrations/1700000000001-First.js": migrationSource("First1700000000001"),
+    });
+    expect(migrationSet({ root, production: true })).toEqual({
+      directory: join(root, "dist/migrations"),
+      compiled: true,
+      files: list,
+    });
+  });
+
+  it("refuses a build output without its list instead of running no migrations", () => {
+    const root = apiRoot({ "dist/main.js": "", "dist/migrations/src/migrations/1700000000001-First.js": "" });
+    expect(() => migrationSet({ root, production: true })).toThrow(`${MIGRATION_LIST} is missing`);
+  });
+
+  it("refuses a list whose files are missing", () => {
+    const root = apiRoot({
+      [`dist/migrations/${MIGRATION_LIST}`]: JSON.stringify([{ file: "1700000000001-First.js", name: "First1700000000001" }]),
+    });
+    expect(() => migrationSet({ root, production: true })).toThrow("Compiled migrations are missing");
+  });
+
+  it("runs source migrations when production code runs without a build", () => {
+    const root = apiRoot({ "src/migrations/1700000000001-First.ts": migrationSource("First1700000000001") });
+    expect(migrationSet({ root, production: true })).toMatchObject({ compiled: false, files: [{ file: "1700000000001-First.ts" }] });
+  });
+
+  it("fails when a runner loaded fewer migrations than the set holds", () => {
+    const root = apiRoot({
+      "src/migrations/1700000000001-First.ts": migrationSource("First1700000000001"),
+      "src/migrations/1700000000002-Second.ts": migrationSource("Second1700000000002"),
+    });
+    const set = migrationSet({ root, production: false });
+    expect(() => assertMigrationsLoaded([], set)).toThrow("Loaded 0 of the 2 migrations");
+    expect(() => assertMigrationsLoaded(loaded("First1700000000001", "Second1700000000002"), set)).not.toThrow();
+  });
+
+  it("fails when the build's listed names did not load", () => {
+    const set = {
+      directory: "dist/migrations",
+      compiled: true,
+      files: [{ file: "1700000000001-First.js", name: "First1700000000001" }],
+    };
+    expect(() => assertMigrationsLoaded(loaded("Other1700000000001"), set)).toThrow("did not load: First1700000000001");
+  });
+
+  it("loads one migration class from each file", async () => {
+    const root = apiRoot({
+      "src/migrations/1700000000001-First.ts": migrationSource("First1700000000001"),
+      "src/migrations/1700000000002-Two.ts": `${migrationSource("A1700000000002")}${migrationSource("B1700000000002")}`,
+    });
+    const set = migrationSet({ root, production: false });
+    await expect(loadMigrations({ ...set, files: set.files.slice(0, 1) })).resolves.toMatchObject([
+      { file: "1700000000001-First.ts", timestamp: 1700000000001, migration: { name: "First1700000000001" } },
+    ]);
+    await expect(loadMigrations(set)).rejects.toThrow("must export exactly one migration class");
+  });
+});

package/dist/templates/fullstack/apps/api/src/database/migration-files.ts

@@ -0,0 +1,134 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import type { MigrationInterface } from "typeorm";
+
+/** The list `scripts/build.mjs` writes next to the compiled migrations. */
+export const MIGRATION_LIST = "migrations.json";
+
+const SOURCE_FILE = /^\d+-.+\.ts$/;
+
+export interface MigrationFile {
+  file: string;
+  /** The migration's name, recorded by the build; unknown for source files until loaded. */
+  name?: string;
+}
+
+export interface MigrationSet {
+  directory: string;
+  /** True for the build output, which lists its migrations in `migrations.json`. */
+  compiled: boolean;
+  /** In timestamp order. */
+  files: MigrationFile[];
+}
+
+export interface MigrationSetOptions {
+  /** The API directory. Defaults to the working directory. */
+  root?: string;
+  /** Reads the build output. Defaults to NODE_ENV=production. */
+  production?: boolean;
+}
+
+function readList(path: string): MigrationFile[] {
+  const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+  if (
+    !Array.isArray(parsed) ||
+    !parsed.every((entry: unknown) =>
+      typeof entry === "object" && entry !== null &&
+      typeof (entry as Record<string, unknown>).file === "string" &&
+      typeof (entry as Record<string, unknown>).name === "string"
+    )
+  ) {
+    throw new Error(`${path} must list { file, name } entries; rebuild the API`);
+  }
+  return parsed as MigrationFile[];
+}
+
+/**
+ * The migrations this process runs. In production that is the build output's
+ * list; a build output without its list fails instead of running none.
+ * Otherwise it is every `<timestamp>-<name>.ts` file in `src/migrations`.
+ */
+export function migrationSet(options: MigrationSetOptions = {}): MigrationSet {
+  const root = options.root ?? process.cwd();
+  const production = options.production ?? process.env.NODE_ENV === "production";
+  const compiled = join(root, "dist", "migrations");
+  const source = join(root, "src", "migrations");
+  if (production && existsSync(join(root, "dist"))) {
+    const list = join(compiled, MIGRATION_LIST);
+    if (!existsSync(list)) {
+      throw new Error(`${list} is missing; build the API with scripts/build.mjs before running it`);
+    }
+    const files = readList(list);
+    const missing = files.filter((entry) => !existsSync(join(compiled, entry.file)));
+    if (missing.length > 0) {
+      throw new Error(`Compiled migrations are missing from ${compiled}: ${missing.map((entry) => entry.file).join(", ")}`);
+    }
+    return { directory: compiled, compiled: true, files };
+  }
+  const files = existsSync(source)
+    ? readdirSync(source).filter((file) => SOURCE_FILE.test(file)).sort().map((file) => ({ file }))
+    : [];
+  return { directory: source, compiled: false, files };
+}
+
+export function migrationPaths(set: MigrationSet): string[] {
+  return set.files.map((entry) => join(set.directory, entry.file));
+}
+
+type MigrationConstructor = new () => MigrationInterface;
+
+function isMigration(value: unknown): value is MigrationConstructor {
+  if (typeof value !== "function") return false;
+  const prototype = (value as { prototype?: unknown }).prototype;
+  if (!prototype || typeof prototype !== "object") return false;
+  const record = prototype as Record<string, unknown>;
+  return typeof record.up === "function" && typeof record.down === "function";
+}
+
+/** TypeORM's name for a migration: its `name` property, else its class name. */
+export function migrationName(migration: MigrationInterface): string {
+  return migration.name || migration.constructor.name;
+}
+
+export interface LoadedMigration {
+  file: string;
+  timestamp: number;
+  migration: MigrationInterface;
+}
+
+/** Imports every file of the set; each must export exactly one migration class. */
+export async function loadMigrations(set: MigrationSet): Promise<LoadedMigration[]> {
+  const loaded: LoadedMigration[] = [];
+  for (const entry of set.files) {
+    const module = await import(pathToFileURL(join(set.directory, entry.file)).href) as Record<string, unknown>;
+    const constructors = Object.values(module).filter(isMigration);
+    const Constructor = constructors[0];
+    if (constructors.length !== 1 || !Constructor) {
+      throw new Error(`Migration ${entry.file} must export exactly one migration class`);
+    }
+    const timestamp = Number(entry.file.slice(0, entry.file.indexOf("-")));
+    if (!Number.isSafeInteger(timestamp)) throw new Error(`Migration ${entry.file} has an invalid timestamp`);
+    loaded.push({ file: entry.file, timestamp, migration: new Constructor() });
+  }
+  return loaded;
+}
+
+/**
+ * Fails unless the migrations a runner loaded are the set: TypeORM loads
+ * nothing, without an error, from a path that matches no file.
+ */
+export function assertMigrationsLoaded(loaded: readonly MigrationInterface[], set: MigrationSet): void {
+  if (loaded.length !== set.files.length) {
+    throw new Error(
+      `Loaded ${loaded.length} of the ${set.files.length} migrations in ${set.directory}; ` +
+        "each migration file must export exactly one migration class",
+    );
+  }
+  if (!set.compiled) return;
+  const names = new Set(loaded.map(migrationName));
+  const absent = set.files.filter((entry) => entry.name && !names.has(entry.name));
+  if (absent.length > 0) {
+    throw new Error(`Migrations listed in ${MIGRATION_LIST} did not load: ${absent.map((entry) => entry.name).join(", ")}`);
+  }
+}

package/dist/templates/fullstack/apps/api/src/database/migration-readiness.spec.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "bun:test";
+import { SQL } from "bun";
+import { pendingMigrationsCheck } from "./migration-readiness";
+
+const set = {
+  directory: "dist/migrations",
+  compiled: true,
+  files: [
+    { file: "1700000000001-First.js", name: "First1700000000001" },
+    { file: "1700000000002-Second.js", name: "Second1700000000002" },
+  ],
+};
+
+describe("pending migrations readiness", () => {
+  it("is down until every listed migration is applied, then stops querying", async () => {
+    const sql = new SQL(":memory:");
+    try {
+      const check = pendingMigrationsCheck(() => sql, set);
+      await expect(check()).rejects.toThrow();
+      await sql`CREATE TABLE "migrations" ("id" integer PRIMARY KEY, "timestamp" bigint, "name" text)`;
+      await sql`INSERT INTO "migrations" ("timestamp", "name") VALUES (1700000000001, 'First1700000000001')`;
+      await expect(check()).rejects.toThrow("1 migrations are pending; run migrate:all: Second1700000000002");
+      await sql`INSERT INTO "migrations" ("timestamp", "name") VALUES (1700000000002, 'Second1700000000002')`;
+      await expect(check()).resolves.toBeUndefined();
+      await sql`DROP TABLE "migrations"`;
+      await expect(check()).resolves.toBeUndefined();
+    } finally {
+      await sql.close();
+    }
+  });
+
+  it("is up without a query when the build has no migrations", async () => {
+    const check = pendingMigrationsCheck(() => { throw new Error("no database"); }, { ...set, files: [] });
+    await expect(check()).resolves.toBeUndefined();
+  });
+});

package/dist/templates/fullstack/apps/api/src/database/migration-readiness.ts

@@ -0,0 +1,25 @@
+import type { SQL } from "bun";
+import type { ReadinessCheck } from "../health/readiness.service";
+import type { MigrationSet } from "./migration-files";
+
+/** Reported down while the database lacks a migration of this build. */
+export const MIGRATIONS_READINESS_CHECK = "migrations";
+
+/**
+ * Compares the migrations table with the build's list. Once every migration is
+ * applied the check stays up without a query: this process never runs one.
+ */
+export function pendingMigrationsCheck(sql: () => SQL, set: MigrationSet): ReadinessCheck {
+  const expected = set.files.flatMap((entry) => entry.name ? [entry.name] : []);
+  let applied = expected.length === 0;
+  return async (): Promise<void> => {
+    if (applied) return;
+    const rows = await sql()<Array<{ name: string }>>`SELECT "name" FROM "migrations"`;
+    const done = new Set(rows.map((row) => row.name));
+    const pending = expected.filter((name) => !done.has(name));
+    if (pending.length > 0) {
+      throw new Error(`${pending.length} migrations are pending; run migrate:all: ${pending.join(", ")}`);
+    }
+    applied = true;
+  };
+}

package/dist/templates/fullstack/apps/api/src/database/run-migrations.spec.ts

@@ -15,6 +15,8 @@ interface LaunchOptions {
   /** Starts the launcher from the directory above the API, like a repository root. */
   fromParent?: boolean;
   files?: Record<string, string>;
+  /** Arguments after the launcher, such as --list. */
+  args?: string[];
 }
 
 /** Runs the migrate:all launcher in an API layout whose entries print their own path. */
@@ -32,7 +34,8 @@ async function launch(entries: string[], nodeEnv: string, body = "", options: La
       mkdirSync(dirname(join(root, path)), { recursive: true });
       writeFileSync(join(root, path), content);
     }
-    const child = Bun.spawn([process.execPath, options.fromParent ? "api/scripts/run-migrations.mjs" : "scripts/run-migrations.mjs"], {
+    const launcher = options.fromParent ? "api/scripts/run-migrations.mjs" : "scripts/run-migrations.mjs";
+    const child = Bun.spawn([process.execPath, launcher, ...(options.args ?? [])], {
       cwd: options.fromParent ? parent : root,
       env: { ...process.env, NODE_ENV: nodeEnv },
       stdout: "pipe",
@@ -68,6 +71,14 @@ describe("migrate:all launcher", () => {
       .toMatchObject({ code: 0, stdout: "dist/migrate.js" });
   });
 
+  it("lists migrations through the application migrator, which needs no auth", async () => {
+    const body = "console.log(process.argv.slice(2).join(' '));\n";
+    expect(await launch(["src/migrate.ts", "src/database/migrate.ts"], "development", body, { args: ["--list"] }))
+      .toMatchObject({ code: 0, stdout: "src/database/migrate.ts\n--list" });
+    expect(await launch(["dist/migrate.js", "dist/database/migrate.js"], "production", body, { args: ["--list"] }))
+      .toMatchObject({ code: 0, stdout: "dist/database/migrate.js\n--list" });
+  });
+
   it("exits with the migration's status", async () => {
     const result = await launch(["src/database/migrate.ts"], "development", "process.exit(3);\n");
     expect(result.code).toBe(3);

package/dist/templates/fullstack/apps/api/src/database/sqlite-migrator.ts

@@ -1,8 +1,6 @@
 import { Database as SqliteDatabase } from "bun:sqlite";
-import { existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
 import type { MigrationInterface, QueryRunner } from "typeorm";
+import { loadMigrations, migrationSet } from "./migration-files";
 
 export interface SqliteMigrationDefinition {
   timestamp: number;
@@ -15,40 +13,8 @@ interface AppliedMigration {
   name: string;
 }
 
-type MigrationConstructor = new () => MigrationInterface;
-
-function isMigration(value: unknown): value is MigrationConstructor {
-  if (typeof value !== "function") return false;
-  const prototype = (value as { prototype?: unknown }).prototype;
-  if (!prototype || typeof prototype !== "object") return false;
-  const record = prototype as Record<string, unknown>;
-  return typeof record.up === "function" && typeof record.down === "function";
-}
-
 async function discoverMigrations(): Promise<SqliteMigrationDefinition[]> {
-  const compiled = join(process.cwd(), "dist", "migrations");
-  const source = join(process.cwd(), "src", "migrations");
-  const directory = process.env.NODE_ENV === "production" && existsSync(compiled)
-    ? compiled
-    : source;
-  if (!existsSync(directory)) return [];
-  const files = readdirSync(directory)
-    .filter((file) => /^\d+-.+\.(?:js|ts)$/.test(file))
-    .sort();
-  const definitions: SqliteMigrationDefinition[] = [];
-  for (const file of files) {
-    const loaded = await import(pathToFileURL(join(directory, file)).href) as Record<string, unknown>;
-    const constructors = Object.values(loaded).filter(isMigration);
-    if (constructors.length !== 1) {
-      throw new Error(`SQLite migration ${file} must export exactly one migration class`);
-    }
-    const timestamp = Number(file.slice(0, file.indexOf("-")));
-    if (!Number.isSafeInteger(timestamp)) throw new Error(`SQLite migration ${file} has an invalid timestamp`);
-    const Constructor = constructors[0];
-    if (!Constructor) throw new Error(`SQLite migration ${file} has no migration class`);
-    definitions.push({ timestamp, migration: new Constructor() });
-  }
-  return definitions;
+  return loadMigrations(migrationSet());
 }
 
 function queryRunner(database: SqliteDatabase): QueryRunner {

package/dist/templates/fullstack/apps/api/src/main.ts

@@ -10,8 +10,8 @@ const app = createApp({ env, services });
 async function bootstrap(): Promise<void> {
   try {
     await services.start();
-    app.listen({ ...apiServerOptions(env), hostname: "0.0.0.0", port: env.PORT });
-    process.stdout.write(`API listening on http://0.0.0.0:${env.PORT}\n`);
+    app.listen({ ...apiServerOptions(env), hostname: env.HOST, port: env.PORT });
+    process.stdout.write(`API listening on http://${env.HOST}:${env.PORT}\n`);
   } catch (error) {
     await services.close();
     throw error;

package/dist/templates/fullstack/apps/api/tsconfig.json

@@ -6,6 +6,8 @@
     "outDir": "dist",
     "rootDir": "src",
     "declaration": false,
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,

package/dist/templates/fullstack/apps/web/package.json

@@ -16,7 +16,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.9.0",
+    "@podosoft/podokit-api-client": "^0.9.1",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/dist/templates/fullstack/apps/web/src/app.css

@@ -121,3 +121,6 @@
   color: var(--sidebar-foreground);
   font-weight: 400;
 }
+
+/* Application styles: @source paths, theme overrides, and base styles. */
+@import "./app.extensions.css";

package/dist/templates/fullstack/apps/web/src/app.extensions.css

@@ -0,0 +1,11 @@
+/*
+ * Application-owned styles. The managed app.css imports this file last, so rules
+ * here come after PodoKit's theme variables and base styles. Add `@source` for
+ * packages whose built components use Tailwind classes, override variables in
+ * `:root` and `.dark`, or add `@theme` entries and base styles, for example:
+ *
+ *   @source "../../../node_modules/@example/ui/dist";
+ *   :root { --radius: 0.5rem; }
+ *
+ * PodoKit creates this file once and never overwrites it.
+ */

package/dist/templates/fullstack/apps/web/src/lib/components/site-runtime.svelte

@@ -4,4 +4,6 @@
   import { ModeWatcher } from "mode-watcher";
 </script>
 
-<ModeWatcher />
+<!-- `.light` on <html> in light mode lets component libraries that follow a `.dark`
+     or `.light` class, and fall back to the OS setting otherwise, match the theme. -->
+<ModeWatcher lightClassNames={["light"]} />

package/dist/templates/fullstack/apps/web/src/lib/server/api.test.ts

@@ -9,6 +9,7 @@ type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
 function requestEvent(fetch: Fetch): RequestEvent {
   return {
     request: new Request("http://app.localhost/services", { headers: { cookie: "session=abc" } }),
+    url: new URL("http://app.localhost/services"),
     getClientAddress: () => "203.0.113.9",
     fetch,
   } as unknown as RequestEvent;
@@ -50,6 +51,24 @@ describe("serverApiClient", () => {
     expect(headers?.get("x-forwarded-for")).toBe("203.0.113.9");
   });
 
+  it("forwards the public origin only when CORS_ORIGIN lists it", async () => {
+    let headers: Headers | undefined;
+    const api = serverApiClient(requestEvent(async (_input, init) => {
+      headers = new Headers(init?.headers);
+      return Response.json({ ok: true });
+    }));
+
+    vi.stubEnv("CORS_ORIGIN", "https://example.com, http://app.localhost");
+    await api.get("/site/settings");
+    expect(headers?.get("x-forwarded-host")).toBe("app.localhost");
+    expect(headers?.get("x-forwarded-proto")).toBe("http");
+
+    vi.stubEnv("CORS_ORIGIN", "https://example.com");
+    await api.get("/site/settings");
+    expect(headers?.has("x-forwarded-host")).toBe(false);
+    expect(headers?.has("x-forwarded-proto")).toBe(false);
+  });
+
   it("gives up on a call that outlasts BACKEND_TIMEOUT_MS", async () => {
     vi.stubEnv("BACKEND_TIMEOUT_MS", "20");
     stubHealth(async () => new Response("ok"));

package/dist/templates/fullstack/apps/web/src/lib/server/api.ts

@@ -8,6 +8,7 @@ import {
   reportBackendAnswer,
   reportBackendFailure,
   resolveClientIp,
+  setForwardedOrigin,
 } from "./backend-proxy";
 
 /** Thrown without contacting the API while it is known to be unreachable. */
@@ -19,7 +20,8 @@ export class BackendUnavailableError extends Error {
 }
 
 // Server-side client for load functions and hooks: points at the internal
-// backend URL and forwards the incoming request's cookies. Each call is bounded
+// backend URL and forwards the incoming request's cookies, client address, and
+// public origin as the /api proxy does. Each call is bounded
 // by BACKEND_TIMEOUT_MS, so a page renders its fallbacks instead of waiting for
 // an API that does not answer.
 export function serverApiClient(event: RequestEvent): ApiClient {
@@ -31,6 +33,7 @@ export function serverApiClient(event: RequestEvent): ApiClient {
       const headers = new Headers(init?.headers);
       if (cookie) headers.set("cookie", cookie);
       if (clientIp) headers.set("x-forwarded-for", clientIp);
+      setForwardedOrigin(headers, event.url);
       const outage = backendOutageSignal();
       const signals = [AbortSignal.timeout(backendTimeoutMs()), outage];
       if (init?.signal) signals.push(init.signal);

package/dist/templates/fullstack/apps/web/src/lib/server/backend-proxy.test.ts

@@ -7,6 +7,7 @@ import {
   bodyLimitFor,
   checkBackend,
   checkIdleTimeout,
+  configuredPublicOrigins,
   envMilliseconds,
   IN_MEMORY_RESPONSE_BYTES,
   proxyRequest,
@@ -16,12 +17,14 @@ import {
   resolveClientIp,
   sortedBodyLimits,
   sortedProxyTimeouts,
+  upstreamFetchOptions,
   withAppHeaders,
 } from "./backend-proxy";
 
 describe("backend proxy client address handling", () => {
   afterEach(() => {
     vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
   });
 
   it("returns the normalized address from a trusted proxy chain", () => {
@@ -74,6 +77,48 @@ describe("backend proxy client address handling", () => {
     expect(upstreamHeaders?.get("x-forwarded-for")).toBe("203.0.113.9");
   });
 
+  it("forwards the public origin a request came in on when CORS_ORIGIN lists it", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+    vi.stubEnv("CORS_ORIGIN", "https://example.com,https://mirror.example.com");
+
+    // The adapter builds the request URL from the gateway's forwarded host and
+    // protocol; a caller's own forwarded headers never reach the API.
+    const request = new Request("https://mirror.example.com/api/mcp/info", {
+      headers: { "x-forwarded-host": "attacker.example", "x-forwarded-proto": "http" },
+    });
+    await proxyRequest(request, "http://api:5002/mcp/info");
+
+    expect(upstreamHeaders?.get("x-forwarded-host")).toBe("mirror.example.com");
+    expect(upstreamHeaders?.get("x-forwarded-proto")).toBe("https");
+  });
+
+  it("forwards no origin that CORS_ORIGIN does not list", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+    vi.stubEnv("CORS_ORIGIN", "https://example.com");
+
+    const request = new Request("http://attacker.example/api/mcp/info", {
+      headers: { "x-forwarded-host": "example.com", "x-forwarded-proto": "https" },
+    });
+    await proxyRequest(request, "http://api:5002/mcp/info");
+
+    expect(upstreamHeaders?.has("x-forwarded-host")).toBe(false);
+    expect(upstreamHeaders?.has("x-forwarded-proto")).toBe(false);
+  });
+
+  it("reads absolute CORS_ORIGIN entries as origins and skips patterns", () => {
+    expect([...configuredPublicOrigins(" https://example.com/ , *.example.com, not a url, http://localhost:5001")])
+      .toEqual(["https://example.com", "http://localhost:5001"]);
+    expect(configuredPublicOrigins("").size).toBe(0);
+  });
+
   // Not forwarding this does not leave the header unset: fetch substitutes its own
   // default, so the API records "node" for every session and the account page shows
   // that as the device for all of them.
@@ -886,6 +931,40 @@ describe("backend proxy application timeouts", () => {
     expect(checks).toBeGreaterThanOrEqual(3);
   });
 
+  it("turns off Bun's fetch idle timeout on a route without a deadline only", async () => {
+    const proxy = await proxyWithTimeouts([{ pathPrefix: "/api/hosts/:hostId/file-transfers", timeoutMs: null }]);
+    const fetch = stubApi(async () => new Response("ok"), async () => Response.json({ done: true }));
+
+    await proxy(
+      new Request("http://app.localhost/api/hosts/h1/file-transfers/t1/commit", { method: "POST", body: "{}" }),
+      "http://api:5002/hosts/h1/file-transfers/t1/commit",
+    );
+    await proxy(new Request("http://app.localhost/api/hosts/h1/notes"), "http://api:5002/hosts/h1/notes");
+
+    const upstream = fetch.mock.calls.filter(([input]) => !String(input).endsWith("/health"));
+    const [commit, notes] = upstream.map(([, init]) => init as RequestInit & { timeout?: unknown });
+    expect(upstream).toHaveLength(2);
+    expect(commit?.timeout).toBe(false);
+    expect(notes).not.toHaveProperty("timeout");
+  });
+
+  it("turns off Bun's fetch idle timeout for a deadline it would cut first", async () => {
+    expect(upstreamFetchOptions(null)).toEqual({ timeout: false });
+    expect(upstreamFetchOptions(600_000)).toEqual({ timeout: false });
+    expect(upstreamFetchOptions(300_000)).toEqual({ timeout: false });
+    expect(upstreamFetchOptions(299_999)).toEqual({});
+    expect(upstreamFetchOptions(30_000)).toEqual({});
+
+    vi.stubEnv("BACKEND_PROXY_TIMEOUT_MS", "300000");
+    vi.stubEnv("CONNECTION_IDLE_TIMEOUT", "0");
+    const proxy = await proxyWithTimeouts([]);
+    const fetch = stubApi(async () => new Response("ok"), async () => Response.json({ done: true }));
+
+    await proxy(new Request("http://app.localhost/api/report"), "http://api:5002/report");
+
+    expect(fetch.mock.calls[0]?.[1]).toHaveProperty("timeout", false);
+  });
+
   it("waits without a deadline on a route with a path parameter", async () => {
     vi.stubEnv("BACKEND_PROXY_TIMEOUT_MS", "20");
     const proxy = await proxyWithTimeouts([{ pathPrefix: "/api/hosts/:hostId/file-transfers", timeoutMs: null }]);