ijihun-planner-studio 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ijihun-planner-studio",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A local owner-only timebox and Mandarart planner with Apple Reminders and Google Tasks bridge support.",
   "type": "module",
   "bin": {

package/server.mjs

@@ -362,11 +362,17 @@ function isUnsafeMethod(method) {
   return !["GET", "HEAD", "OPTIONS"].includes(method || "GET");
 }
 
-function originAllowed(req) {
+function originAllowed(req, options = {}) {
   const origin = req.headers.origin;
   if (!origin) return true;
   const normalized = normalizeOrigin(origin);
-  if (!normalized) return false;
+  if (!normalized) {
+    return Boolean(
+      options.allowNullOrigin
+      && String(origin).trim() === "null"
+      && trustedOrigins.has(requestOrigin(req))
+    );
+  }
   return trustedOrigins.has(normalized) || normalized === requestOrigin(req);
 }
 
@@ -524,9 +530,10 @@ async function handleAuth(req, res, url) {
       else sendJson(res, 503, { ok: false, error: "Owner authentication is not configured" }, corsHeaders(req));
       return true;
     }
-    if (!originAllowed(req)) {
+    if (!originAllowed(req, { allowNullOrigin: formLogin })) {
       logOriginBlocked(req, url.pathname);
-      sendJson(res, 403, { ok: false, error: "Origin not allowed" }, corsHeaders(req));
+      if (formLogin) redirect(res, "/login?error=1");
+      else sendJson(res, 403, { ok: false, error: "Origin not allowed" }, corsHeaders(req));
       return true;
     }