From e661e3738f5b02d7c7c409704b61e609c871fffb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Tue, 4 Aug 2026 13:01:54 +0000 Subject: [PATCH] scripts: make the light installs localhost-native, and stop relaxing guards for it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A light install is reached at localhost on the machine running it, so PUBLIC_URL has exactly one right answer. setup.sh required it with a re-prompt loop; under the light profile it now defaults to http://localhost:$PORT. The macOS installer already did this — this is parity, and it removes the one prompt in a light run whose answer a non-technical user could not be expected to produce. setup_mac_light.sh also wrote PUBLIC_BUILD_ENV="development", justified in a comment as "what makes plain http://localhost work". That is no longer true, and the cost of it is not small. IS_DEV_BUILD gates exactly three things: origin validation already off regardless — ALLOW_ANY_ORIGIN defaults to true password rules validatePassword is skipped entirely on change-password rate limiting the limiter returns next() before doing anything So the only live effects were losing the last two, for a benefit that another default already provided. It now writes "production", matching setup.sh. Nothing about localhost needed relaxing: browsers treat http://localhost as a secure context, so passkeys, getUserMedia and the clipboard all work over plain HTTP, and passkeys in particular derive their RP ID from the request origin rather than a configured domain. That last point is the boundary worth knowing: http://192.168.x.x is NOT a secure context, so reaching a light install from another device means putting an HTTPS proxy in front of it. Recorded in the comments at both prompts. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/setup.sh | 24 ++++++++++++++++++------ scripts/setup_mac_light.sh | 9 +++++---- 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/scripts/setup.sh b/scripts/setup.sh index ed4055a7..a14828a5 100755 --- a/scripts/setup.sh +++ b/scripts/setup.sh @@ -888,13 +888,25 @@ if [ "$GENERATE_ENV" = true ]; then read -r ENV_PORT ENV_PORT="${ENV_PORT:-9010}" - echo -n " PUBLIC_URL (required): " - read -r ENV_PUBLIC_URL - while [ -z "$ENV_PUBLIC_URL" ]; do - warn "PUBLIC_URL is required" - echo -n " PUBLIC_URL: " + # A light install is reached at localhost on the machine running it, so there is exactly one right + # answer and no reason to make someone produce it. Plain HTTP is fine there: browsers treat + # http://localhost as a secure context, so passkeys, microphone capture and the clipboard all work + # without TLS. That stops being true over the LAN — http://192.168.x.x is NOT a secure context and + # those APIs fail in browser-specific ways — so reaching a light install from another device means + # putting an HTTPS proxy in front of it. + if is_light; then + echo -n " PUBLIC_URL [http://localhost:$ENV_PORT]: " read -r ENV_PUBLIC_URL - done + ENV_PUBLIC_URL="${ENV_PUBLIC_URL:-http://localhost:$ENV_PORT}" + else + echo -n " PUBLIC_URL (required): " + read -r ENV_PUBLIC_URL + while [ -z "$ENV_PUBLIC_URL" ]; do + warn "PUBLIC_URL is required" + echo -n " PUBLIC_URL: " + read -r ENV_PUBLIC_URL + done + fi echo -n " DATA_PATH [$REAL_HOME/.local/data]: " read -r ENV_DATA_PATH diff --git a/scripts/setup_mac_light.sh b/scripts/setup_mac_light.sh index 784507a7..a0771b15 100755 --- a/scripts/setup_mac_light.sh +++ b/scripts/setup_mac_light.sh @@ -365,9 +365,10 @@ ENV_PUBLIC_URL="" if [ "$WRITE_ENV" = "1" ]; then echo "" ask ENV_PORT "PORT" "9010" - # PUBLIC_BUILD_ENV=development makes IS_DEV_BUILD true, which short-circuits origin validation - # (isOriginAllowed returns true immediately) and relaxes rate limits and password rules. That is - # what makes plain http://localhost work with no HTTPS reverse proxy in front. + # Plain http://localhost needs nothing relaxed to work: browsers treat it as a secure context, so + # passkeys, microphone capture and the clipboard are all available without TLS, and origin checking + # is already off by default (ALLOW_ANY_ORIGIN). Reaching this from another device is the case that + # needs an HTTPS proxy — http://192.168.x.x is not a secure context and those APIs fail there. ask ENV_PUBLIC_URL "PUBLIC_URL" "http://localhost:$ENV_PORT" ask ENV_DATA_PATH "DATA_PATH" "$HOME/.local/data" ask ENV_ITEMS_DIR "OFFICER_ITEMS_DIR" "$(dirname "$PROJECT_DIR")/officer-items" @@ -385,7 +386,7 @@ if [ "$WRITE_ENV" = "1" ]; then PORT="$ENV_PORT" JWT_SECRET="$JWT_SECRET" PUBLIC_URL="$ENV_PUBLIC_URL" -PUBLIC_BUILD_ENV="development" +PUBLIC_BUILD_ENV="production" DATA_PATH="$ENV_DATA_PATH" OFFICER_ITEMS_DIR="$ENV_ITEMS_DIR" HOME_DIR="$HOME"