fix: preserve original host through forward auth

packages/dev-server/test/gateway.test.ts

@@ -52,12 +52,37 @@ test("forward auth describes the original gateway request", () => {
 
   expect(headers.get("x-forwarded-host")).toBe("admin.example.test");
   expect(headers.get("x-forwarded-proto")).toBe("https");
+  expect(headers.get("x-original-host")).toBe("admin.example.test");
+  expect(headers.get("x-original-proto")).toBe("https");
   expect(headers.get("x-original-method")).toBe("GET");
   expect(headers.get("x-original-uri")).toBe("/settings?tab=security");
   expect(headers.get("cookie")).toBe("session=abc");
   expect(headers.get("authorization")).toBe("Bearer token");
 });
 
+test("nested SSO proxy keeps the protected app's original request headers", () => {
+  const authHeaders = forwardAuthHeaders(
+    new Request("http://admin.localhost:3000/settings", {
+      headers: { host: "admin.localhost:3000" },
+    }),
+  );
+  authHeaders.set("host", "sso.localhost:3000");
+  const verifierRequest = new Request("http://sso.localhost:3000/api/verify", {
+    headers: authHeaders,
+  });
+
+  const proxied = gatewayProxyHeaders(
+    verifierRequest,
+    new URL(verifierRequest.url),
+    "127.0.0.1",
+    true,
+  );
+
+  expect(proxied.get("x-forwarded-host")).toBe("sso.localhost:3000");
+  expect(proxied.get("x-original-host")).toBe("admin.localhost:3000");
+  expect(proxied.get("x-original-uri")).toBe("/settings");
+});
+
 test("gateway respawns development apps after an HMR restart exit", () => {
   expect(gatewayRestartDelay("development", 97, null)).toBe(0);
   expect(gatewayRestartDelay("development", 1, null)).toBe(1200);