fix(selfhost): require PUBLIC_API_ORIGIN for Orb setup wizard — prevent Host-header redirect attack

Same class of vulnerability as the main setup wizard fix: the Orb wizard
derived the manifest origin from PUBLIC_API_ORIGIN ?? request.url.origin,
allowing an attacker to spoof the Host header and redirect the App-creation
callback to an attacker-controlled domain to steal the Orb App credentials.

Remove the request.url fallback from both setup wizards; return 400 when
PUBLIC_API_ORIGIN is unset.

Author: JSONbored

src/server.ts

@@ -213,7 +213,16 @@ async function main(): Promise<void> {
         if (path === "/metrics") return new Response(await renderMetrics(), { headers: { "content-type": "text/plain; version=0.0.4" } });
         // First-run GitHub App setup wizard — only while no App is configured (can't rebind a live install).
         if ((path === "/setup" || path === "/setup/callback") && !process.env.GITHUB_APP_ID) {
-          const origin = process.env.PUBLIC_API_ORIGIN ?? new URL(request.url).origin;
+          // PUBLIC_API_ORIGIN is required: falling back to request.url.origin would let an attacker spoof
+          // the Host header and redirect the App-creation callback to an attacker-controlled domain, where
+          // they could exchange the one-time code for the App private key and webhook secret.
+          const origin = process.env.PUBLIC_API_ORIGIN;
+          if (!origin) {
+            return new Response(
+              "PUBLIC_API_ORIGIN must be set before using the setup wizard — add it to your .env file",
+              { status: 400 },
+            );
+          }
           if (path === "/setup") {
             // Generate a per-visit CSRF nonce, embed it in the manifest's redirect_url, and bind it to
             // this browser session via an HttpOnly cookie so the callback can validate it.
@@ -247,7 +256,14 @@ async function main(): Promise<void> {
         }
         // Gittensory Orb setup wizard — only while no Orb App is configured.
         if ((path === "/orb/setup" || path === "/orb/setup/callback") && !process.env.ORB_APP_ID) {
-          const origin = process.env.PUBLIC_API_ORIGIN ?? new URL(request.url).origin;
+          // Same guard as the main setup wizard: PUBLIC_API_ORIGIN required to prevent Host-header spoofing.
+          const origin = process.env.PUBLIC_API_ORIGIN;
+          if (!origin) {
+            return new Response(
+              "PUBLIC_API_ORIGIN must be set before using the Orb setup wizard — add it to your .env file",
+              { status: 400 },
+            );
+          }
           if (path === "/orb/setup") {
             const state = randomUUID();
             return new Response(renderOrbSetupPage(origin, state), {