0.34.6_repo_cleanup

src/settings/public_origin.rs

@@ -1,5 +1,3 @@
-// Normalize the browser-facing HTTPS origin independently of the optional
-// additional DNS allowlist. It is never inferred from forwarding headers.
 fn normalize_public_admin_origin(public_origin: &str) -> Result<String> {
     ensure!(
         public_origin.len() <= 255 && !public_origin.chars().any(|c| matches!(c, '@' | '#' | '?' | ',' | '\\')),
@@ -15,8 +13,6 @@ fn normalize_public_admin_origin(public_origin: &str) -> Result<String> {
     );
     let authority = uri.authority()
         .context("administration public_origin requires an authority")?;
-    // This setting is for a named HTTPS origin. Use the existing direct
-    // listener/Host policy for IP addresses and localhost.
     let host = crate::config::normalize_host(authority.host())?;
     ensure!(
         host.parse::<std::net::IpAddr>().is_err() && host != "localhost",
@@ -34,20 +30,15 @@ fn normalize_public_admin_origin(public_origin: &str) -> Result<String> {
 }
 
 impl Administration {
-    /// The origin is validated and normalized before it is stored, so this
-    /// returns only its DNS hostname (never a forwarded or client-supplied host).
     pub fn public_origin_host(&self) -> Option<&str> {
         self.public_origin.as_deref()
             .and_then(|url| url.strip_prefix("https://"))
             .and_then(|authority| authority.split(':').next())
     }
-    /// Used only by the explicitly opted-in panel session-cookie passthrough.
     pub fn explicitly_allowed_panel_host(&self, host: &str) -> bool {
         self.allowed_hosts.iter().any(|allowed| allowed.eq_ignore_ascii_case(host))
             || self.public_origin_host().is_some_and(|name| name.eq_ignore_ascii_case(host))
     }
-    /// Build the access-control allowlist for the active/desired panel state.
-    /// Never mutate the saved configuration or accumulate stale hosts on edits.
     pub fn include_public_origin_host(&mut self) {
         if let Some(host) = self.public_origin_host().map(str::to_owned) {
             if !self.allowed_hosts.iter().any(|allowed| allowed.eq_ignore_ascii_case(&host)) {

src/settings/tests.rs

@@ -287,8 +287,6 @@ mod tests {
         assert_eq!(old_pin.allowed_hosts, vec!["other.example.test".to_owned()]);
         assert!(old_pin.explicitly_allowed_panel_host("panel.example.test"));
         assert!(old_pin.explicitly_allowed_panel_host("other.example.test"));
-        // Additional hosts are independent: editing/removing the pinned origin
-        // must not leave its former hostname in the saved strict list.
         let mut changed = admin.clone();
         changed.public_origin = Some("https://other.example.test".into());
         changed.validate(&tls).unwrap();