Allow CORS origins in safeRedirect hosts

Local Vite continue URLs use absolute localhost origins that never
pass verified custom-domain checks. Reuse AllowedOrigins so post-auth
redirects work in dev without disabling Validate.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/api.go

@@ -21,7 +21,6 @@
 package api
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"net/http"
@@ -49,6 +48,7 @@ import (
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/resourcealias"
 	"go.probo.inc/probo/pkg/riskmanagement"
+	"go.probo.inc/probo/pkg/saferedirect"
 	"go.probo.inc/probo/pkg/securecookie"
 	agent_v1 "go.probo.inc/probo/pkg/server/api/agent/v1"
 	connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
@@ -262,13 +262,11 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.TokenSecret,
 			cfg.File,
 			cfg.BaseURL,
-			func(ctx context.Context, host string) bool {
-				if host == cfg.BaseURL.Host() {
-					return true
-				}
-
-				return cfg.Visitor.IsVerifiedRedirectHost(ctx, host)
-			},
+			saferedirect.Any(
+				saferedirect.StaticHosts(cfg.BaseURL.Host()),
+				saferedirect.Origins(cfg.AllowedOrigins...),
+				cfg.Visitor.IsVerifiedRedirectHost,
+			),
 			cfg.GraphQLLimits,
 		),
 		agentHandler: agent_v1.NewMux(

pkg/server/api/complianceportal/v1/mux.go

@@ -15,7 +15,6 @@
 package complianceportal_v1
 
 import (
-	"context"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
@@ -27,6 +26,7 @@ import (
 	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/mailman"
 	"go.probo.inc/probo/pkg/resourcealias"
+	"go.probo.inc/probo/pkg/saferedirect"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server"
 	"go.probo.inc/probo/pkg/server/api/authn"
@@ -37,6 +37,7 @@ import (
 type MuxConfig struct {
 	BaseURL           *baseurl.BaseURL
 	ExtraHeaderFields map[string]string
+	AllowedOrigins    []string
 	Logger            *log.Logger
 	IAM               *iam.Service
 	Visitor           *visitor.Service
@@ -66,9 +67,10 @@ func NewMux(cfg MuxConfig) (http.Handler, error) {
 	r.Get("/robots.txt", markdownHandler.HandleRobotsTxt)
 	r.Get("/sitemap.xml", markdownHandler.HandleSitemap)
 
-	allowedHost := func(ctx context.Context, host string) bool {
-		return cfg.Visitor.IsVerifiedRedirectHost(ctx, host)
-	}
+	allowedHost := saferedirect.Any(
+		saferedirect.Origins(cfg.AllowedOrigins...),
+		cfg.Visitor.IsVerifiedRedirectHost,
+	)
 
 	oauthInitiateHandler := NewOAuthInitiateHandler(
 		cfg.BaseURL,