create-ailk 0.11.1 → 0.11.2

package/templates/apps/api/src/config/index.ts

@@ -17,6 +17,16 @@ export interface Config {
   PORT: number;
   FRONTEND_URL: string;
 
+  // The browser origins this API trusts (#7395) — the one list CORS, the
+  // cookie-forwarded write check (middleware/auth.ts) and the checkout
+  // redirect lock (routes/checkout/sessions.ts) all read. Resolved once, at
+  // startup, by resolveTrustedOrigins() below from FRONTEND_URL's origin plus
+  // the opt-in AILK_TRUSTED_ORIGINS (a comma-separated list of exact origins,
+  // for a hub that serves its Admin app and spoke sites). Frozen; no request
+  // input can add to it, and no entry can be `*` or a wildcard host.
+  TRUSTED_ORIGINS: readonly string[];
+  AILK_TRUSTED_ORIGINS?: string;
+
   // Local Database (for auth: User, Session, ApiToken, etc.). Required in
   // production; unset elsewhere starts the API database-less (#6482).
   DATABASE_URL?: string;
@@ -94,6 +104,103 @@ export interface Config {
   CAL_WEBHOOK_SECRET?: string;
 }
 
+/** Why an AILK_TRUSTED_ORIGINS entry was refused (#7395 D2). */
+export type TrustedOriginRefusal =
+  | 'wildcard'
+  | 'unparseable'
+  | 'scheme'
+  | 'not-canonical'
+  | 'trailing-dot';
+
+/** The zero-config development origin (`apps/web`'s `pnpm dev`). */
+const DEV_FRONTEND_ORIGIN = 'http://localhost:3000';
+
+/** `FRONTEND_URL`'s origin, or null when it is unusable as one (#7395 D2). */
+function primaryOrigin(raw: string): string | null {
+  // A comma means a list was put in the wrong variable:
+  // new URL('https://a.example,https://b.example').origin is 'https://a.example,https'.
+  if (raw.includes('*') || raw.includes(',')) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return null;
+  // WHATWG decodes a percent-encoded host: `https://%2A.example.com` has origin
+  // `https://*.example.com`, which the raw-string check above cannot see.
+  if (parsed.origin.includes('*')) return null;
+  return parsed.origin;
+}
+
+/** Why one AILK_TRUSTED_ORIGINS entry is refused, or null when it is an exact origin. */
+function refuseExtra(entry: string, nodeEnv: Config['NODE_ENV']): TrustedOriginRefusal | null {
+  // WHATWG parses `https://*.example.com` and keeps it as its own origin, so
+  // the wildcard is refused by name, before the parse (spec § 1.3).
+  if (entry.includes('*')) return 'wildcard';
+  let parsed: URL;
+  try {
+    parsed = new URL(entry);
+  } catch {
+    return 'unparseable';
+  }
+  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && nodeEnv !== 'production')) {
+    return 'scheme';
+  }
+  // Written exactly as a browser serialises an Origin header: lower-case
+  // punycode host, no default port, path, trailing slash or userinfo.
+  if (entry !== parsed.origin) return 'not-canonical';
+  // `https://a.example.` is a different origin from `https://a.example`.
+  if (parsed.hostname.endsWith('.')) return 'trailing-dot';
+  return null;
+}
+
+/**
+ * The trusted browser-origin allowlist (#7395 D2). Pure; `validateConfig()`
+ * calls it once.
+ *
+ * - `FRONTEND_URL` is normalised to its origin, as the checkout lock always
+ *   did; unset outside production it is the dev default. Unset in production,
+ *   or unusable (unparseable, not http(s), or containing `*` or `,`), it
+ *   contributes nothing, and `primaryUnusable` reports the latter.
+ * - `AILK_TRUSTED_ORIGINS` entries must already be exact origins, https-only in
+ *   production. A refused entry is reported by 1-based position and reason —
+ *   never its text, which may carry userinfo or a misplaced secret.
+ *
+ * The result is de-duplicated in first-seen order and frozen.
+ */
+export function resolveTrustedOrigins(env: {
+  FRONTEND_URL?: string | undefined;
+  AILK_TRUSTED_ORIGINS?: string | undefined;
+  NODE_ENV: Config['NODE_ENV'];
+}): {
+  origins: readonly string[];
+  refused: { position: number; reason: TrustedOriginRefusal }[];
+  primaryUnusable: boolean;
+} {
+  const origins: string[] = [];
+  const refused: { position: number; reason: TrustedOriginRefusal }[] = [];
+  let primaryUnusable = false;
+
+  if (env.FRONTEND_URL) {
+    const primary = primaryOrigin(env.FRONTEND_URL);
+    if (primary === null) primaryUnusable = true;
+    else origins.push(primary);
+  } else if (env.NODE_ENV !== 'production') {
+    origins.push(DEV_FRONTEND_ORIGIN);
+  }
+
+  (env.AILK_TRUSTED_ORIGINS ?? '').split(',').forEach((piece, index) => {
+    const entry = piece.trim();
+    if (!entry) return;
+    const reason = refuseExtra(entry, env.NODE_ENV);
+    if (reason !== null) refused.push({ position: index + 1, reason });
+    else origins.push(entry);
+  });
+
+  return { origins: Object.freeze([...new Set(origins)]), refused, primaryUnusable };
+}
+
 /** Enabled modules whose state lives in the database (see validateConfig). */
 const DATABASE_MODULES = [
   'commerce',
@@ -135,10 +242,39 @@ function validateConfig(): Config {
     );
   }
 
+  // #7395 D3 — a refused AILK_TRUSTED_ORIGINS entry stops the API in every
+  // environment: the variable is opt-in, and an entry dropped silently would
+  // resurface as the very 401 it was added to fix. Position and reason only,
+  // never the entry's text. console.error too, because pino-pretty's worker
+  // transport can drop the last line written before exit.
+  const trusted = resolveTrustedOrigins({
+    FRONTEND_URL: process.env.FRONTEND_URL,
+    AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
+    NODE_ENV: nodeEnv,
+  });
+  if (trusted.refused.length > 0) {
+    const message =
+      '❌ AILK_TRUSTED_ORIGINS has entries that are not exact http(s) origins (https only in production; no `*`, path, trailing slash or userinfo)';
+    logger.error({ refused: trusted.refused }, message);
+    console.error(message, JSON.stringify({ refused: trusted.refused }));
+    process.exit(1);
+  }
+  // #7395 D5 — a set-but-unusable FRONTEND_URL predates this list, so it is
+  // logged rather than fatal. The value is never echoed.
+  if (trusted.primaryUnusable) {
+    logger.error(
+      "FRONTEND_URL is set but is not an absolute http(s) URL without '*' or ',' — it is not a trusted origin",
+    );
+  }
+
   return {
     NODE_ENV: nodeEnv,
     PORT: parseInt(process.env.PORT || '3002', 10),
     FRONTEND_URL: process.env.FRONTEND_URL || 'http://localhost:3000',
+    TRUSTED_ORIGINS: trusted.origins,
+    ...(process.env.AILK_TRUSTED_ORIGINS !== undefined && {
+      AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
+    }),
 
     ...(process.env.DATABASE_URL !== undefined && {
       DATABASE_URL: process.env.DATABASE_URL,

package/templates/apps/api/src/middleware/__tests__/adversarial/bearer-token-format.test.ts

@@ -37,7 +37,7 @@ import { authPreHandlerPlugin } from "../../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/cookie-or-bearer-precedence.test.ts

@@ -38,7 +38,7 @@ const BEARER = "tok_live_xyz";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-bearer-skip.test.ts

@@ -33,7 +33,7 @@ const BEARER = "tok_live_abc";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;
 }

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-cookie-path.test.ts

@@ -35,7 +35,7 @@ const COOKIE_NAME = "better-auth.session_token";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   // HEAD is auto-registered by Fastify when GET is declared; no explicit handler needed.
@@ -72,7 +72,7 @@ describe("S13 adversarial — CSRF on cookie path", () => {
     expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
   });
 
-  it("rejects POST when Origin scheme differs from the configured frontendOrigin", async () => {
+  it("rejects POST when Origin scheme differs from the configured trusted origin", async () => {
     app = buildApp();
     await app.ready();
 

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-trusted-origins.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @file csrf-trusted-origins.test.ts (#7395 AC-3)
+ *
+ * The cookie path's CSRF check against a multi-origin allowlist. A spoke site
+ * forwards the visitor's cookie and the browser's real `Origin` to the hub
+ * API, so a write is accepted iff that `Origin` is EXACTLY one of the
+ * configured trusted origins — never a prefix, a suffix or the first entry
+ * alone — and an empty list refuses every cookie write in every environment
+ * (the dev fail-open is gone, spec D4/D6.2). The non-rejecting resolver the
+ * checkout route uses applies the same check (#6866 D2).
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin, resolveOptionalCookieUser } from "../../auth.js";
+
+const HUB = "https://hub.example";
+const SPOKE_A = "https://spoke-a.example";
+const TRUSTED = [HUB, SPOKE_A];
+const COOKIE = "better-auth.session_token=sess_tok_abc";
+
+function buildApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { trustedOrigins });
+  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+function buildResolverApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.post("/resolve", async (req) =>
+    resolveOptionalCookieUser(req, { trustedOrigins }),
+  );
+  return app;
+}
+
+function post(app: FastifyInstance, url: string, origin?: string) {
+  return app.inject({
+    method: "POST",
+    url,
+    headers: { cookie: COOKIE, ...(origin !== undefined && { origin }) },
+  });
+}
+
+describe("#7395 — cookie-path CSRF against the trusted-origin allowlist", () => {
+  const originalNodeEnv = process.env.NODE_ENV;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_42",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    if (originalNodeEnv === undefined) delete process.env.NODE_ENV;
+    else process.env.NODE_ENV = originalNodeEnv;
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it.each([HUB, SPOKE_A])(
+    "accepts a cookie POST from the listed origin %s",
+    async (origin) => {
+      app = buildApp(TRUSTED);
+      await app.ready();
+
+      const res = await post(app, "/echo", origin);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ userId: "usr_42" });
+    },
+  );
+
+  it.each([
+    ["an unlisted spoke", "https://spoke-b.example"],
+    ["a listed origin as a host prefix", "https://spoke-a.example.evil.test"],
+    ["an opaque origin", "null"],
+    ["a case variant of a listed origin", "HTTPS://HUB.EXAMPLE"],
+    ["a listed origin with a trailing slash", "https://hub.example/"],
+    ["a listed origin with its default port", "https://hub.example:443"],
+    ["a missing Origin", undefined],
+  ])("refuses a cookie POST from %s with 401", async (_label, origin) => {
+    app = buildApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/echo", origin);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("refuses every cookie POST with an empty list, even in development", async () => {
+    process.env.NODE_ENV = "development";
+    app = buildApp([]);
+    await app.ready();
+
+    const res = await post(app, "/echo", HUB);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("resolveOptionalCookieUser returns the user for a listed spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", SPOKE_A);
+
+    expect(res.json()).toEqual({ kind: "user", userId: "usr_42" });
+  });
+
+  it("resolveOptionalCookieUser returns none/cross_origin for an unlisted spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", "https://spoke-b.example");
+
+    expect(res.json()).toEqual({ kind: "none", reason: "cross_origin" });
+  });
+});

package/templates/apps/api/src/middleware/__tests__/adversarial/session-fixation.test.ts

@@ -40,7 +40,7 @@ const COOKIE_NAME = "better-auth.session_token";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/session-timeout.test.ts

@@ -46,7 +46,7 @@ let CURRENT_TIME = 1_000_000_000_000;
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.bearer-path.test.ts

@@ -37,7 +37,7 @@ const BEARER_HASH = createHash("sha256").update(BEARER).digest("hex");
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.both-present-precedence.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.cookie-path.test.ts

@@ -33,7 +33,7 @@ const FRONTEND = "https://app.example.com";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.database-not-configured.test.ts

@@ -31,7 +31,7 @@ const echoHandler = jest.fn(async () => ({ ok: true }));
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", echoHandler);
   app.post("/echo", echoHandler);

package/templates/apps/api/src/middleware/__tests__/auth.neither-present.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async () => ({ ok: true }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.optional-cookie.test.ts

@@ -28,7 +28,7 @@ const COOKIE = "better-auth.session_token=sess_tok_abc.signature";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.post("/resolve", async (req) =>
-    resolveOptionalCookieUser(req, { frontendOrigin: FRONTEND }),
+    resolveOptionalCookieUser(req, { trustedOrigins: [FRONTEND] }),
   );
   return app;
 }

package/templates/apps/api/src/middleware/auth.ts

@@ -8,9 +8,10 @@
  *      Looked up directly against the `Session` table (the row Better Auth's
  *      database adapter creates on sign-in). Cookie wins when both modes are
  *      present (locked by brief decision OQ-D / spec §3 "Both present").
- *      Non-GET requests with a cookie are required to carry a same-origin
- *      Origin header — the lightweight CSRF mechanism agreed in OQ-D. Bearer-
- *      authenticated callers skip the origin check (non-browser flow).
+ *      Non-GET requests with a cookie are required to carry an Origin header
+ *      that is exactly one of the configured trusted origins (#7395) — the
+ *      lightweight CSRF mechanism agreed in OQ-D. Bearer-authenticated callers
+ *      skip the origin check (non-browser flow).
  *
  *   2. Bearer path — Authorization: Bearer <token>. The token is sha256-hashed
  *      and matched against `ApiToken.token` (stored as hash). Revoked / expired
@@ -120,27 +121,21 @@ function readBearer(request: FastifyRequest): string | undefined {
 }
 
 /**
- * Same-origin CSRF check for cookie-authenticated mutating requests.
+ * CSRF check for cookie-authenticated mutating requests (#7395).
  * Returns true if the request is safe (GET/HEAD/OPTIONS) or the Origin header
- * matches the configured frontend origin. False otherwise.
+ * is exactly one of the trusted origins. False otherwise — including for any
+ * write when the list is empty, in every environment.
  */
 function isOriginAllowed(
   request: FastifyRequest,
-  frontendOrigin: string | undefined,
+  trustedOrigins: readonly string[],
 ): boolean {
   const method = request.method.toUpperCase();
   if (method === "GET" || method === "HEAD" || method === "OPTIONS")
     return true;
-  if (!frontendOrigin) {
-    // No FRONTEND_URL configured: fail OPEN in dev/test (zero-config OSS
-    // boot), fail CLOSED in production (security review M1 — with the
-    // multi-tenant module's state-changing routes, an unset origin must not
-    // silently disable the CSRF check in a real deployment).
-    return process.env.NODE_ENV !== "production";
-  }
   const origin = request.headers.origin;
   if (!origin) return false;
-  return origin === frontendOrigin;
+  return trustedOrigins.includes(origin);
 }
 
 type SessionRow = {
@@ -187,8 +182,11 @@ async function resolveBearerToken(
 }
 
 export type AuthPreHandlerOptions = {
-  /** Configured frontend origin used for the CSRF same-origin check. */
-  frontendOrigin?: string | undefined;
+  /**
+   * The browser origins a cookie-authenticated write may come from — exact
+   * matches only. server.ts passes `config.TRUSTED_ORIGINS` (#7395).
+   */
+  trustedOrigins: readonly string[];
 };
 
 /**
@@ -214,7 +212,7 @@ export type OptionalCookieUser =
  * route's buyer stamp).
  *
  * Applies the cookie path's own rules — the same private cookie reader,
- * Session lookup, expiry comparison and same-origin check as
+ * Session lookup, expiry comparison and trusted-origin check as
  * `makeAuthPreHandler` — so the two paths cannot drift. Reads the COOKIE only:
  * a bearer `ApiToken` never identifies a user here. Never writes a reply and
  * never throws; every failure is a `none` with its reason. The cookie is
@@ -238,7 +236,7 @@ export async function resolveOptionalCookieUser(
   if (session.expiresAt.getTime() <= getClock().now()) {
     return { kind: "none", reason: "expired" };
   }
-  if (!isOriginAllowed(request, opts.frontendOrigin)) {
+  if (!isOriginAllowed(request, opts.trustedOrigins)) {
     return { kind: "none", reason: "cross_origin" };
   }
   // Brand assertion at the Prisma read edge (ADR-0031 rule 5), as above.
@@ -251,8 +249,8 @@ export async function resolveOptionalCookieUser(
  * Exported standalone so route-test suites can register it directly without
  * spinning up the full server module.
  */
-export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
-  const { frontendOrigin } = opts;
+export function makeAuthPreHandler(opts: AuthPreHandlerOptions) {
+  const { trustedOrigins } = opts;
   return async function authPreHandler(
     request: FastifyRequest,
     reply: FastifyReply,
@@ -272,7 +270,7 @@ export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
         () => undefined,
       );
       if (session && session.expiresAt.getTime() > now) {
-        if (!isOriginAllowed(request, frontendOrigin)) {
+        if (!isOriginAllowed(request, trustedOrigins)) {
           reply.code(401).send(UNAUTHORIZED);
           return;
         }

package/templates/apps/api/src/routes/auth/__tests__/auth-tokens.functional.test.ts

@@ -42,7 +42,7 @@ const FRONTEND = "https://app.example.com";
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.register(tokenRoutes);
   await app.ready();
   return app;

package/templates/apps/api/src/routes/auth/__tests__/auth-user.functional.test.ts

@@ -37,7 +37,7 @@ const FRONTEND = "https://app.example.com";
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.register(userRoutes);
   await app.ready();
   return app;