fix(self-host): tie the public address to a single origin (#2605)

fluxer_media_proxy/src/config/mod.rs

@@ -121,6 +121,10 @@ impl Config {
             !secret_key.is_empty(),
             "FLUXER_MEDIA_PROXY_SECRET_KEY is required"
         );
+        let (public_base_domain, public_port) =
+            fluxer_common::config::resolve_public_domain_and_port(|name| {
+                env.get(name).map(ToOwned::to_owned)
+            })?;
 
         Ok(Self {
             node_env: env.get("NODE_ENV").unwrap_or("development").to_owned(),
@@ -134,8 +138,15 @@ impl Config {
                 8080,
             )?,
             secret_key,
-            public_endpoint: non_empty(env.get("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT"))
-                .map(|endpoint| endpoint.trim_end_matches('/').to_owned()),
+            public_endpoint: non_empty(env.get("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT")).map(
+                |endpoint| {
+                    fluxer_common::config::normalize_public_endpoint(
+                        endpoint.trim_end_matches('/'),
+                        &public_base_domain,
+                        public_port,
+                    )
+                },
+            ),
             mode,
             read_only: parse_bool(
                 "FLUXER_MEDIA_PROXY_READ_ONLY",

fluxer_media_proxy/src/config/tests/mod.rs

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+mod public_endpoint;
 mod s3_read;
 
 use super::*;

fluxer_media_proxy/src/config/tests/public_endpoint.rs

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use super::env_with;
+use crate::config::Config;
+
+const ENDPOINT: &str = "https://chat.example.com/media";
+
+#[test]
+fn a_non_default_public_port_reaches_the_public_endpoint() {
+    let cfg = Config::load_from_iter(env_with(&[
+        ("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT", ENDPOINT),
+        ("FLUXER_BASE_DOMAIN", "chat.example.com"),
+        ("FLUXER_PUBLIC_PORT", "29080"),
+    ]))
+    .expect("config loads");
+    assert_eq!(
+        Some("https://chat.example.com:29080/media".to_owned()),
+        cfg.public_endpoint
+    );
+}
+
+#[test]
+fn the_public_origin_supplies_the_port() {
+    let cfg = Config::load_from_iter(env_with(&[
+        ("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT", ENDPOINT),
+        ("FLUXER_PUBLIC_ORIGIN", "https://chat.example.com:29080"),
+        ("FLUXER_BASE_DOMAIN", "chat.example.com"),
+        ("FLUXER_PUBLIC_PORT", "443"),
+    ]))
+    .expect("config loads");
+    assert_eq!(
+        Some("https://chat.example.com:29080/media".to_owned()),
+        cfg.public_endpoint
+    );
+}
+
+#[test]
+fn an_unrelated_host_keeps_its_endpoint() {
+    let cfg = Config::load_from_iter(env_with(&[
+        (
+            "FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT",
+            "https://cdn.other.example/media",
+        ),
+        ("FLUXER_BASE_DOMAIN", "chat.example.com"),
+        ("FLUXER_PUBLIC_PORT", "29080"),
+    ]))
+    .expect("config loads");
+    assert_eq!(
+        Some("https://cdn.other.example/media".to_owned()),
+        cfg.public_endpoint
+    );
+}
+
+#[test]
+fn a_default_public_port_keeps_the_endpoint_portless() {
+    let cfg = Config::load_from_iter(env_with(&[
+        ("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT", ENDPOINT),
+        ("FLUXER_BASE_DOMAIN", "chat.example.com"),
+        ("FLUXER_PUBLIC_PORT", "443"),
+    ]))
+    .expect("config loads");
+    assert_eq!(Some(ENDPOINT.to_owned()), cfg.public_endpoint);
+}
+
+#[test]
+fn a_malformed_public_port_is_refused() {
+    let error = Config::load_from_iter(env_with(&[
+        ("FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT", ENDPOINT),
+        ("FLUXER_BASE_DOMAIN", "chat.example.com"),
+        ("FLUXER_PUBLIC_PORT", "not-a-port"),
+    ]))
+    .expect_err("a malformed port is refused");
+    assert!(error.to_string().contains("FLUXER_PUBLIC_PORT"));
+}