From dcb23b0a8674f2d1e6edef35cee4fa6cc078fc60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Padez?= <andre.padez@gmail.com>
Date: Sat, 25 Jul 2026 13:43:57 +0000
Subject: [PATCH] server: allowed origin from PUBLIC_URL; repoint web assets to
 the new domain

origin-validation: the production web origin now reads from PUBLIC_URL (.env), e.g.
https://officer.pastilhas.dev, instead of a hardcoded domain; drop alpha.officer.dev.
officer-web/index.html: point og:image/favicon/manifest/etc. at the new domain (served
locally from public/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/apps/officer-web/index.html               | 16 ++++++++--------
 src/servers/_middlewares/origin-validation.ts | 15 ++++++++++++---
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/apps/officer-web/index.html b/src/apps/officer-web/index.html
index e1d874ba..a33cabe1 100644
--- a/src/apps/officer-web/index.html
+++ b/src/apps/officer-web/index.html
@@ -10,25 +10,25 @@
     <meta property="og:type" content="website" />
     <meta property="og:title" content="Officer Dev (Alpha)" />
     <meta property="og:description" content="Your all-purpose AI operating system. Personal AI assistant, terminal, file browser, code editor, and customizable dashboards — all self-hosted." />
-    <meta property="og:image" content="https://alpha.officer.dev/og-image-v3.jpg" />
-    <meta property="og:image:secure_url" content="https://alpha.officer.dev/og-image-v3.jpg" />
+    <meta property="og:image" content="https://officer.pastilhas.dev/og-image-v3.jpg" />
+    <meta property="og:image:secure_url" content="https://officer.pastilhas.dev/og-image-v3.jpg" />
     <meta property="og:image:width" content="1200" />
     <meta property="og:image:height" content="630" />
     <meta property="og:image:type" content="image/jpeg" />
-    <meta property="og:url" content="https://alpha.officer.dev" />
+    <meta property="og:url" content="https://officer.pastilhas.dev" />
     <meta property="og:site_name" content="Officer Dev" />
 
     <!-- Twitter Card -->
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="Officer Dev (Alpha)" />
     <meta name="twitter:description" content="Your all-purpose AI operating system. Personal AI assistant, terminal, file browser, code editor, and customizable dashboards — all self-hosted." />
-    <meta name="twitter:image" content="https://alpha.officer.dev/og-image-v3.jpg" />
+    <meta name="twitter:image" content="https://officer.pastilhas.dev/og-image-v3.jpg" />
 
     <!-- Favicons & App Icons -->
-    <link rel="icon" type="image/x-icon" href="https://alpha.officer.dev/favicon.ico" />
-    <link rel="icon" type="image/png" sizes="96x96" href="https://alpha.officer.dev/favicon-96x96.png" />
-    <link rel="apple-touch-icon" sizes="180x180" href="https://alpha.officer.dev/apple-touch-icon.png" />
-    <link rel="manifest" href="https://alpha.officer.dev/site.webmanifest" />
+    <link rel="icon" type="image/x-icon" href="https://officer.pastilhas.dev/favicon.ico" />
+    <link rel="icon" type="image/png" sizes="96x96" href="https://officer.pastilhas.dev/favicon-96x96.png" />
+    <link rel="apple-touch-icon" sizes="180x180" href="https://officer.pastilhas.dev/apple-touch-icon.png" />
+    <link rel="manifest" href="https://officer.pastilhas.dev/site.webmanifest" />
     <meta name="theme-color" content="#1F2620" />
 
     <script src="https://cdn.jsdelivr.net/npm/eruda"></script>
diff --git a/src/servers/_middlewares/origin-validation.ts b/src/servers/_middlewares/origin-validation.ts
index 2d11b3b3..025def78 100644
--- a/src/servers/_middlewares/origin-validation.ts
+++ b/src/servers/_middlewares/origin-validation.ts
@@ -1,11 +1,20 @@
 import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 
-const { PUBLIC_BUILD_ENV, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
+const { PUBLIC_BUILD_ENV, PUBLIC_URL, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
+
+// The allowed production web origin comes from PUBLIC_URL in .env (e.g. https://officer.pastilhas.dev),
+// not a hardcoded domain.
+const PUBLIC_ORIGIN = (() => {
+  try {
+    return PUBLIC_URL ? new URL(PUBLIC_URL).origin : undefined;
+  } catch {
+    return undefined;
+  }
+})();
 
 const WEB_ORIGINS: Record<string, string[]> = {
-  alpha: ['https://alpha.officer.dev'],
-  production: ['https://app.officer.dev', 'https://edge.officer.dev'],
+  production: PUBLIC_ORIGIN ? [PUBLIC_ORIGIN] : [],
 };
 
 const CHROME_EXTENSIONS: string[] = [