From 764ee441bd3a19f8fa4f565824f7519653e4fa37 Mon Sep 17 00:00:00 2001
From: Void <void@gamecult.org>
Date: Wed, 11 Nov 2026 01:31:26 +0000
Subject: [PATCH] auth: the register entry takes https only, http only for a
 local host (Heimdall)

registrationEntry accepts an https url, or http when the host is localhost, *.localhost, 127.0.0.1 or ::1. A test pins both sides, including a look-alike host. The two tests that pass config.json as a ClientConfig now cast it, so tsc is clean for them.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/app/hooks/useClientConfig.test.ts        |  4 ++--
 src/app/pages/auth/registrationEntry.test.ts | 12 +++++++++++-
 src/app/pages/auth/registrationEntry.ts      | 13 ++++++++++---
 3 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/src/app/hooks/useClientConfig.test.ts b/src/app/hooks/useClientConfig.test.ts
index a2004d2f..440ba15c 100644
--- a/src/app/hooks/useClientConfig.test.ts
+++ b/src/app/hooks/useClientConfig.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { clientDefaultServer } from './useClientConfig';
+import { ClientConfig, clientDefaultServer } from './useClientConfig';
 import config from '../../../config.json';
 
 describe('default homeserver', () => {
@@ -15,6 +15,6 @@ describe('default homeserver', () => {
   });
 
   it('is gamecult.org in the repo config.json too', () => {
-    expect(clientDefaultServer(config)).toBe('gamecult.org');
+    expect(clientDefaultServer(config as ClientConfig)).toBe('gamecult.org');
   });
 });
diff --git a/src/app/pages/auth/registrationEntry.test.ts b/src/app/pages/auth/registrationEntry.test.ts
index 3af32faa..53b15fb7 100644
--- a/src/app/pages/auth/registrationEntry.test.ts
+++ b/src/app/pages/auth/registrationEntry.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { registrationEntry } from './registrationEntry';
+import type { ClientConfig } from '../../hooks/useClientConfig';
 import {
   PREVIEW_NOTICE_TEXT,
   TRAINING_NOTICE_TEXT,
@@ -17,7 +18,7 @@ describe('registration entry', () => {
   });
 
   it('ships off in config.json', () => {
-    expect(registrationEntry(config)).toBeUndefined();
+    expect(registrationEntry(config as ClientConfig)).toBeUndefined();
     expect(config.registration.enabled).toBe(false);
   });
 
@@ -44,4 +45,13 @@ describe('registration entry', () => {
     const entry = registrationEntry({ previewDemo: true, registration: { enabled: true, url } });
     expect(entry?.notice).toBe(PREVIEW_NOTICE_TEXT);
   });
+
+  it('accepts http only for a local development host', () => {
+    const on = (u: string) => registrationEntry({ registration: { enabled: true, url: u } });
+    expect(on('http://localhost:8080/register')?.url).toBe('http://localhost:8080/register');
+    expect(on('http://127.0.0.1:8080/register')).toBeDefined();
+    expect(on('http://accounts.example/register')).toBeUndefined();
+    expect(on('http://localhost.evil.example/register')).toBeUndefined();
+    expect(on('https://accounts.example/register')).toBeDefined();
+  });
 });
diff --git a/src/app/pages/auth/registrationEntry.ts b/src/app/pages/auth/registrationEntry.ts
index 3049403e..6c65732e 100644
--- a/src/app/pages/auth/registrationEntry.ts
+++ b/src/app/pages/auth/registrationEntry.ts
@@ -3,17 +3,24 @@ import { TRAINING_NOTICE_VERSION, trainingNoticeText } from '../../utils/trainin
 
 export type RegistrationEntry = { url: string; notice: string; noticeVersion: number };
 
+// Plain http is for a developer's own machine only; a stranger's sign-up page is https.
+const isLocalHost = (hostname: string): boolean =>
+  hostname === 'localhost' ||
+  hostname.endsWith('.localhost') ||
+  hostname === '127.0.0.1' ||
+  hostname === '[::1]';
+
 /**
  * The sign-up entry the sign-in page may show: the account service's registration page, when the
- * switch is on and the configured url is a plain http(s) address. Anything else is no entry. The
+ * switch is on and the configured url is an https address (http only for localhost). Anything else is no entry. The
  * consent sentence and its version are trainingNotice.ts's, the ones a room shows.
  */
 export const registrationEntry = (config: ClientConfig): RegistrationEntry | undefined => {
   const { enabled, url } = config.registration ?? {};
   if (enabled !== true || typeof url !== 'string') return undefined;
   try {
-    const { protocol } = new URL(url);
-    if (protocol !== 'https:' && protocol !== 'http:') return undefined;
+    const { protocol, hostname } = new URL(url);
+    if (protocol !== 'https:' && !(protocol === 'http:' && isLocalHost(hostname))) return undefined;
   } catch {
     return undefined;
   }