Add an optional PENPOT_TRUSTED_ORIGINS setting listing alternate origins
as bare scheme://host[:port] entries. Matching is exact on the trimmed,
lowercased Origin; unlisted origins and requests without Origin keep the
canonical public-uri, and server-to-server or queued work is unchanged.
Malformed entries produce a startup warning and never match.
Stamp the trusted origin on each request with a global http middleware
that binds config public-uri for the request extent. Expose the chain as
root-middleware so tests can assert trusted-origin runs before auth and
errors. Email links, asset URLs, audit and webhook link fields, and
redirects then use the alternate base while serving that request.
Carry the origin through OIDC in the signed state, since the IdP
callback is a navigation without Origin: auth and organization SSO store
it, and the callback re-applies it with with-public-uri for the token
exchange redirect_uri and every redirect target, including the logout
post-logout redirect. Verify the state token once per callback and reuse
the claims. Build redirect URIs with the uniform ensure-path-slash plus
join pattern so subpaths survive, using append-query-param for hash
routes.
Closes#11625
AI-assisted-by: deepseek-v4.1-flash
AI-assisted-by: qwen3.7-plus
AI-assisted-by: gpt-5.6-luna
f43cc96f15