fix: initialize hosted Studio behind HTTPS reverse proxies

scripts/verify-deployment.ts

@@ -56,6 +56,28 @@ try {
   const application = await (
     await fetch(origin + "/design-studio/api/application")
   ).json();
+  // Browser module requests carry Origin; the VM forwards them over plain HTTP.
+  const publicOrigin =
+    process.env.STUDIO_PUBLIC_ORIGIN ?? "https://component.wrnexusjs.dev";
+  const proxiedHeaders = {
+    origin: publicOrigin,
+    host: new URL(publicOrigin).host,
+  };
+  for (const path of [
+    "/design-studio/studio.js",
+    "/design-studio/api/application",
+  ]) {
+    const proxied = await fetch(origin + path, { headers: proxiedHeaders });
+    if (!proxied.ok)
+      throw Error(
+        `HTTPS-origin request over HTTP failed: ${path} (${proxied.status})`,
+      );
+  }
+  const rejected = await fetch(origin + "/design-studio/studio.js", {
+    headers: { ...proxiedHeaders, origin: "https://attacker.example" },
+  });
+  if (rejected.status !== 403)
+    throw Error("Cross-origin Studio requests were not rejected.");
   const generation = await (
     await fetch(origin + "/design-studio/api/generation")
   ).json();