Critical Securities (5) fixes

src/servers/_middlewares/origin-validation.ts

@@ -3,38 +3,39 @@ import * as errors from '../custom-errors';
 
 const { PUBLIC_BUILD_ENV } = process.env;
 
-const ALLOWED_ORIGINS: Record<string, string[]> = {
-  staging: ['https://staging.officer.dev'],
+const WEB_ORIGINS: Record<string, string[]> = {
+  alpha: ['https://alpha.officer.dev'],
   production: ['https://app.officer.dev', 'https://edge.officer.dev'],
 };
 
+const CHROME_EXTENSIONS: string[] = [
+  // 'chrome-extension://<id>'
+];
+
+const APP_ORIGINS: string[] = [
+  // Future: mobile app / webview origins
+];
+
 export function isOriginAllowed(origin: string | undefined, host?: string): boolean {
-  // Dev environment: allow any origin
   if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {
     return true;
   }
 
-  // If origin is present, validate it
   if (origin) {
-    // Chrome extension check
     if (origin.startsWith('chrome-extension://')) {
-      if (PUBLIC_BUILD_ENV === 'staging') {
-        return true; // Allow any extension in staging
-      }
-      if (PUBLIC_BUILD_ENV === 'production') {
-        return origin === 'chrome-extension://fjooappefigppfjolhadliepialebodg';
-      }
+      return CHROME_EXTENSIONS.includes(origin);
     }
 
-    // Web origin check
-    const allowed = ALLOWED_ORIGINS[PUBLIC_BUILD_ENV];
+    if (APP_ORIGINS.includes(origin)) {
+      return true;
+    }
+
+    const allowed = WEB_ORIGINS[PUBLIC_BUILD_ENV];
     return !!allowed?.includes(origin);
   }
 
-  // No origin header: allow same-origin requests by checking Host header
-  // This handles cases where browsers don't send Origin for same-origin requests
   if (host) {
-    const allowed = ALLOWED_ORIGINS[PUBLIC_BUILD_ENV];
+    const allowed = WEB_ORIGINS[PUBLIC_BUILD_ENV];
     return !!allowed?.some((o) => o.endsWith(host));
   }