From 41b57a61deb564c2c0865835fd868df81138ac2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Mon, 13 Apr 2026 16:50:43 +0400
Subject: [PATCH] Canonicalize cookie banner origin on save
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Strip www. prefix and trailing slash from origin when creating or
updating a cookie banner so CORS lookups match regardless of whether
the customer's site redirects www to the apex domain.

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 pkg/cookiebanner/service.go | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/pkg/cookiebanner/service.go b/pkg/cookiebanner/service.go
index 51a70c8bf..6b55d4a00 100644
--- a/pkg/cookiebanner/service.go
+++ b/pkg/cookiebanner/service.go
@@ -19,6 +19,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/url"
+	"strings"
 	"time"
 
 	"go.gearno.de/kit/pg"
@@ -154,6 +156,23 @@ func (r *CreateCookieConsentRecordRequest) Validate() error {
 	return v.Error()
 }
 
+func canonicalizeOrigin(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return raw
+	}
+
+	host := u.Hostname()
+	host = strings.TrimPrefix(host, "www.")
+
+	port := u.Port()
+	if port != "" {
+		return u.Scheme + "://" + host + ":" + port
+	}
+
+	return u.Scheme + "://" + host
+}
+
 func buildSnapshot(
 	banner *coredata.CookieBanner,
 	categories coredata.CookieCategories,
@@ -250,7 +269,7 @@ func (s *Service) CreateCookieBanner(
 				ID:                gid.New(scope.GetTenantID(), coredata.CookieBannerEntityType),
 				OrganizationID:    req.OrganizationID,
 				Name:              req.Name,
-				Origin:            req.Origin,
+				Origin:            canonicalizeOrigin(req.Origin),
 				State:             coredata.CookieBannerStateActive,
 				PrivacyPolicyURL:  req.PrivacyPolicyURL,
 				ConsentExpiryDays: req.ConsentExpiryDays,
@@ -413,7 +432,7 @@ func (s *Service) UpdateCookieBanner(
 				banner.Name = *req.Name
 			}
 			if req.Origin != nil {
-				banner.Origin = *req.Origin
+				banner.Origin = canonicalizeOrigin(*req.Origin)
 			}
 			if req.PrivacyPolicyURL != nil {
 				banner.PrivacyPolicyURL = *req.PrivacyPolicyURL