relayAllowedOrigin function

String? relayAllowedOrigin(
  1. String? origin
)

The CORS answer for a relay request's origin: the allowlisted taskpane origins get their origin echoed back (never * — a hostile page must not be able to read this proxy), anything else gets null (= no CORS headers = the browser blocks the read).

Implementation

// ponytail: exact fa1.dev + localhost dev; extend the list when the pane
// gains another production origin.
String? relayAllowedOrigin(String? origin) {
  if (origin == null) return null;
  final uri = Uri.tryParse(origin);
  final host = uri?.host ?? '';
  const allowedHosts = {'fa1.dev'};
  final localhost = host == 'localhost' || host.endsWith('.localhost');
  return (allowedHosts.contains(host) || localhost) ? origin : null;
}