fix(mobile,relay): remote session attach — E2EE OUT decrypt + Origins editor

desktop/frontend/src/mobile/MobileTerminal.vue

@@ -561,7 +561,7 @@ onMounted(() => {
         if (term.cols > 0 && term.rows > 0) conn?.sendResize(term.cols, term.rows)
       }
     },
-  })
+  }, { remote: true })
   conn.attach()
   refreshInputMode()
   reloadBars()

internal/relay/admin_http.go

@@ -341,6 +341,11 @@ type adminConfigResponse struct {
 	Debug        bool `json:"debug"`
 	DebugPayload bool `json:"debug_payload"`
 
+	// AllowedOrigins is the current HTTP/WS Origin allow-list. Editable via
+	// PUT with allowed_origins in the body. An empty list means "any origin"
+	// (dev mode). Mobile Capacitor clients need "capacitor://localhost" here.
+	AllowedOrigins []string `json:"allowed_origins"`
+
 	Version string `json:"version"`
 }
 
@@ -422,6 +427,7 @@ func (s *Server) adminConfigResponse() adminConfigResponse {
 		DefaultMaxConnectionsPerKey: defaultMaxConnections,
 		Debug:                       s.debugOn(),
 		DebugPayload:                s.debugPayloadOn(),
+		AllowedOrigins:              append([]string(nil), cfg.AllowedOrigins...),
 		Version:                     s.cfg.Version,
 	}
 }

internal/relay/version_test.go

@@ -195,6 +195,96 @@ func TestAdminConfigPersistsRuntimeLimits(t *testing.T) {
 	}
 }
 
+// TestAdminConfigRoundtripsAllowedOrigins verifies the admin UI can read the
+// current allow-list and PUT a new one. The hot-apply path (SetAllowedOrigins
+// + OriginPatterns) is exercised implicitly: after the PUT, the server's
+// accept options carry the normalized patterns (host-only) so that a mobile
+// WS from Origin capacitor://localhost survives nhooyr's origin check.
+func TestAdminConfigRoundtripsAllowedOrigins(t *testing.T) {
+	ctx := context.Background()
+	store, err := userstore.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { store.Close() })
+
+	u, err := store.CreateOpaqueUser(ctx, "admin@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.SetUserAdmin(ctx, u.ID, true); err != nil {
+		t.Fatal(err)
+	}
+	tok, _, err := store.CreateSession(ctx, u.ID, "ua", "1.2.3.0/24", 24*time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cfgStore := NewAdminConfigStore(store, AdminConfig{
+		AllowedOrigins: []string{"https://relay.example.com"},
+	})
+	resolver := NewIdentityResolver(store)
+	srv := NewServer(Config{
+		Resolver:         resolver,
+		Store:            store,
+		AdminConfigStore: cfgStore,
+		AllowedOrigins:   []string{"relay.example.com"},
+	})
+
+	// GET returns the stored list verbatim (not the normalized host patterns).
+	getReq := httptest.NewRequest(http.MethodGet, "/admin/api/config", nil)
+	getReq.Header.Set("Authorization", "Bearer "+tok)
+	getRec := httptest.NewRecorder()
+	srv.ServeHTTP(getRec, getReq)
+	if getRec.Code != http.StatusOK {
+		t.Fatalf("GET status=%d body=%s; want 200", getRec.Code, getRec.Body.String())
+	}
+	var got struct {
+		AllowedOrigins []string `json:"allowed_origins"`
+	}
+	if err := json.NewDecoder(getRec.Body).Decode(&got); err != nil {
+		t.Fatalf("decode GET: %v", err)
+	}
+	if len(got.AllowedOrigins) != 1 || got.AllowedOrigins[0] != "https://relay.example.com" {
+		t.Fatalf("GET allowed_origins=%#v; want [https://relay.example.com]", got.AllowedOrigins)
+	}
+
+	// PUT with a mobile-inclusive list must persist AND hot-apply so that
+	// WS from capacitor://localhost (host=localhost) survives the origin check.
+	putBody := strings.NewReader(`{
+		"rate_limit_per_minute": 0,
+		"max_connections_per_key": 0,
+		"allowed_origins": ["https://relay.example.com", "capacitor://localhost"]
+	}`)
+	putReq := httptest.NewRequest(http.MethodPut, "/admin/api/config", putBody)
+	putReq.Header.Set("Authorization", "Bearer "+tok)
+	putReq.Header.Set("Content-Type", "application/json")
+	putRec := httptest.NewRecorder()
+	srv.ServeHTTP(putRec, putReq)
+	if putRec.Code != http.StatusOK {
+		t.Fatalf("PUT status=%d body=%s; want 200", putRec.Code, putRec.Body.String())
+	}
+
+	snap := cfgStore.Snapshot()
+	if len(snap.AllowedOrigins) != 2 || snap.AllowedOrigins[1] != "capacitor://localhost" {
+		t.Fatalf("persisted allowed_origins=%#v; want [https://relay.example.com capacitor://localhost]", snap.AllowedOrigins)
+	}
+
+	// Hot-apply: acceptOptions must now use host-only patterns so nhooyr's
+	// authenticateOrigin can match Origin capacitor://localhost (host=localhost).
+	patterns := srv.currentAllowedOrigins()
+	sawLocalhost := false
+	for _, p := range patterns {
+		if p == "localhost" {
+			sawLocalhost = true
+			break
+		}
+	}
+	if !sawLocalhost {
+		t.Fatalf("after PUT, allowedOrigins patterns=%#v; want to include host-only 'localhost'", patterns)
+	}
+}
+
 func TestRateLimitRejectsExcessRequests(t *testing.T) {
 	srv := NewServer(Config{Version: "v1.2.3", RateLimitPerMinute: 1})
 

internal/relay/web-dist/admin/index.html

@@ -7,18 +7,18 @@
   <meta name="theme-color" content="#0b1020" />
   <title>AT Term · admin</title>
   <link rel="icon" href="/icon.svg" type="image/svg+xml" />
-  <script type="module" crossorigin src="/assets/admin--XP86shj.js"></script>
-  <link rel="modulepreload" crossorigin href="/assets/mobile-guard-CHHXRZ12.js">
-  <link rel="modulepreload" crossorigin href="/assets/client-Bd6vJHn4.js">
-  <link rel="modulepreload" crossorigin href="/assets/pwa-DV81pmUS.js">
-  <link rel="modulepreload" crossorigin href="/assets/Topbar-qQtT5o6t.js">
-  <link rel="modulepreload" crossorigin href="/assets/FormItem-KX1KLzyv.js">
-  <link rel="modulepreload" crossorigin href="/assets/Switch-_UDIVDNp.js">
-  <link rel="modulepreload" crossorigin href="/assets/Tabs-BHw_WMcN.js">
-  <link rel="modulepreload" crossorigin href="/assets/Alert-CTGJYwHC.js">
+  <script type="module" crossorigin src="/assets/admin-YJxcuJKk.js"></script>
+  <link rel="modulepreload" crossorigin href="/assets/mobile-guard-BvFpjCXb.js">
+  <link rel="modulepreload" crossorigin href="/assets/client-BRiQMdFT.js">
+  <link rel="modulepreload" crossorigin href="/assets/pwa-BRtGQKIK.js">
+  <link rel="modulepreload" crossorigin href="/assets/Topbar-Cz_j_mBL.js">
+  <link rel="modulepreload" crossorigin href="/assets/FormItem-Biv8w1Bg.js">
+  <link rel="modulepreload" crossorigin href="/assets/Switch-CX4ypJCN.js">
+  <link rel="modulepreload" crossorigin href="/assets/Tabs-BsN_G19n.js">
+  <link rel="modulepreload" crossorigin href="/assets/Alert-Dj-XqAz8.js">
   <link rel="stylesheet" crossorigin href="/assets/mobile-guard-CMCsLwt1.css">
   <link rel="stylesheet" crossorigin href="/assets/Topbar-CxSILtQc.css">
-  <link rel="stylesheet" crossorigin href="/assets/admin-C5VBGqPU.css">
+  <link rel="stylesheet" crossorigin href="/assets/admin-BHn3CSbt.css">
 <link rel="manifest" href="/manifest.webmanifest"></head>
 <body>
   <div id="app"></div>