fix: use public origins for SSO redirects

packages/dev-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.2.70",
+  "version": "0.2.71",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/dev-server/src/gateway.ts

@@ -166,10 +166,13 @@ export function forwardAuthFailure(res: Response, verifierUrl: string): Response
 }
 
 /** Describe the original gateway request to a forward-auth verifier. */
-export function forwardAuthHeaders(req: Request): Headers {
+export function forwardAuthHeaders(req: Request, publicOrigin?: string): Headers {
   const original = new URL(req.url);
   const host = req.headers.get("host") ?? original.host;
-  const protocol = original.protocol.replace(":", "");
+  const protocol = (publicOrigin ? new URL(publicOrigin).protocol : original.protocol).replace(
+    ":",
+    "",
+  );
   return new Headers({
     cookie: req.headers.get("cookie") ?? "",
     authorization: req.headers.get("authorization") ?? "",
@@ -194,6 +197,7 @@ async function checkAuth(
   req: Request,
   ip: string,
   internalOrigins: Readonly<Record<string, string>>,
+  publicOrigin?: string,
 ): Promise<Response | null> {
   if (!auth) return null;
 
@@ -225,7 +229,7 @@ async function checkAuth(
 
     try {
       const res = await fetch(verifyUrl, {
-        headers: forwardAuthHeaders(req),
+        headers: forwardAuthHeaders(req, publicOrigin),
         redirect: "manual",
       });
       if (!res.ok) {
@@ -492,7 +496,7 @@ export async function startGateway(opts: GatewayOptions): Promise<RunningGateway
         }
 
         // Per-app access control (basic auth / IP allowlist / forward-auth).
-        const denied = await checkAuth(target.auth, req, ip, internalOrigins);
+        const denied = await checkAuth(target.auth, req, ip, internalOrigins, target.publicOrigin);
         if (denied) {
           if (sec.accessLog)
             console.log(

packages/dev-server/test/gateway.test.ts

@@ -85,6 +85,18 @@ test("forward auth describes the original gateway request", () => {
   expect(headers.get("authorization")).toBe("Bearer token");
 });
 
+test("forward auth uses the protected app public protocol", () => {
+  const headers = forwardAuthHeaders(
+    new Request("http://127.0.0.1:10050/settings", {
+      headers: { host: "admin.wrnx.in" },
+    }),
+    "https://admin.wrnx.in",
+  );
+
+  expect(headers.get("x-original-host")).toBe("admin.wrnx.in");
+  expect(headers.get("x-original-proto")).toBe("https");
+});
+
 test("nested SSO proxy keeps the protected app's original request headers", () => {
   const authHeaders = forwardAuthHeaders(
     new Request("http://admin.localhost:3000/settings", {