mirror of
https://github.com/penpot/penpot.git
synced 2026-11-15 06:31:02 +00:00
f43cc96f15
Add an optional PENPOT_TRUSTED_ORIGINS setting listing alternate origins as bare scheme://host[:port] entries. Matching is exact on the trimmed, lowercased Origin; unlisted origins and requests without Origin keep the canonical public-uri, and server-to-server or queued work is unchanged. Malformed entries produce a startup warning and never match. Stamp the trusted origin on each request with a global http middleware that binds config public-uri for the request extent. Expose the chain as root-middleware so tests can assert trusted-origin runs before auth and errors. Email links, asset URLs, audit and webhook link fields, and redirects then use the alternate base while serving that request. Carry the origin through OIDC in the signed state, since the IdP callback is a navigation without Origin: auth and organization SSO store it, and the callback re-applies it with with-public-uri for the token exchange redirect_uri and every redirect target, including the logout post-logout redirect. Verify the state token once per callback and reuse the claims. Build redirect URIs with the uniform ensure-path-slash plus join pattern so subpaths survive, using append-query-param for hash routes. Closes #11625 AI-assisted-by: deepseek-v4.1-flash AI-assisted-by: qwen3.7-plus AI-assisted-by: gpt-5.6-luna
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.