fix(media-proxy): allow the desktop app origin and preflight (#3325)

fluxer_media_proxy/src/config/parse.rs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
 use super::{BucketStyle, DeploymentMode, PolicyMode, StorageBackend};
-use crate::secret::SecretBytes;
+use crate::{constants::DESKTOP_APP_ORIGIN, secret::SecretBytes};
 use base64::{Engine as _, engine::general_purpose};
 use http::HeaderValue;
 
@@ -121,6 +121,9 @@ fn parse_origin(entry: &str) -> Option<HeaderValue> {
     if !entry.is_ascii() {
         return None;
     }
+    if entry == DESKTOP_APP_ORIGIN {
+        return Some(HeaderValue::from_static(DESKTOP_APP_ORIGIN));
+    }
     let url = url::Url::parse(entry).ok()?;
     let bare = matches!(url.scheme(), "http" | "https")
         && url.host().is_some_and(is_origin_host)

fluxer_media_proxy/src/config/tests/cors.rs

@@ -66,6 +66,11 @@ fn allowed_origins_are_normalised_to_their_browser_serialisation() {
         ("https://web.fluxer.app/", vec!["https://web.fluxer.app"]),
         ("https://web.fluxer.app:443", vec!["https://web.fluxer.app"]),
         ("http://localhost:8088", vec!["http://localhost:8088"]),
+        ("fluxer-app://app", vec!["fluxer-app://app"]),
+        (
+            "https://web.fluxer.app,fluxer-app://app,fluxer-app://app",
+            vec!["https://web.fluxer.app", "fluxer-app://app"],
+        ),
         ("http://127.0.0.1:8088", vec!["http://127.0.0.1:8088"]),
         ("http://[::1]:8088", vec!["http://[::1]:8088"]),
         (
@@ -94,7 +99,11 @@ fn rejects_an_allowed_origin_that_is_not_a_bare_http_origin() {
         "web.fluxer.app",
         "ftp://web.fluxer.app",
         "file:///tmp/x",
-        "fluxer-app://app",
+        "fluxer-app://app/",
+        "fluxer-app://evil",
+        "fluxer-app://app:443",
+        "FLUXER-APP://APP",
+        "other-app://app",
         "https://[email protected]",
         "https://user:[email protected]",
         "https://web.fluxer.app/app",