Fix CSP blocking OIDC token endpoint

[maxbrc]

Calculate the origin URL for AUTH_AUTHORITY and add it to CSP_DOMAINS.
Fixes #679

Documentation

• Documentation is not needed

Summary by CodeRabbit

• Bug Fixes
  • Improved app compatibility with authentication endpoints by correctly allowing the auth service’s origin in the content security policy.
  • Reduced issues caused by using full auth URLs, helping sign-in and related flows work more reliably.

[coderabbitai]

📝 Walkthrough

Walkthrough

The docker/init_react_envs.sh script is updated so that when AUTH_AUTHORITY is set, only its origin (scheme + host + port) is extracted via sed and appended to CSP_DOMAINS, instead of appending the full AUTH_AUTHORITY URL including its path.

Changes

CSP Origin Extraction Fix

Layer / File(s)	Summary
Strip path from AUTH_AUTHORITY before adding to CSP_DOMAINS docker/init_react_envs.sh	Introduces AUTH_AUTHORITY_ORIGIN computed by stripping everything after the host via sed, and appends that origin to CSP_DOMAINS instead of the full AUTH_AUTHORITY value.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A path too long crept into the rule,
blocking the token — oh, how cruel!
With a snip of sed, just origin stays,
the auth endpoint flows through the haze.
Hippity-hop, the CSP's now cool! 🌟

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the fix and documentation choice, but it omits the required issue ticket number/link section from the template.	Add the issue ticket number and a link under the required section, and keep the documentation selection as shown.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: fixing CSP so the OIDC token endpoint is no longer blocked.
Linked Issues check	✅ Passed	The change matches issue #679 by using the AUTH_AUTHORITY origin in CSP_DOMAINS to allow the token endpoint.
Out of Scope Changes check	✅ Passed	The patch is narrowly scoped to the CSP origin fix and does not introduce unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/init_react_envs.sh`:
- Around line 94-95: The AUTH_AUTHORITY_ORIGIN derivation in init_react_envs.sh
only strips path segments, so query strings and fragments can leak into the CSP
list. Update the AUTH_AUTHORITY_ORIGIN extraction logic to normalize
AUTH_AUTHORITY to a true origin by removing any trailing ?query or `#fragment` as
well as any path, then keep appending it to CSP_DOMAINS. Use the existing
AUTH_AUTHORITY_ORIGIN and CSP_DOMAINS variables in the shell block to locate the
change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 58dd68b0-345c-4e99-a843-9476fc2bbba2

📥 Commits

Reviewing files that changed from the base of the PR and between 76529fc and cbda14d.

📒 Files selected for processing (1)

• docker/init_react_envs.sh

Missing checks before approval

[jnfrati]

Hey @maxbrc thanks for the contribution!
Could you check the failing CI on this PR? Everything looks good beyond that 🙌

[maxbrc]

Thanks @jnfrati! Fixed the failing check (docs checkbox in the template). CodeRabbit had a point but it was out of scope, it's resolved.

[CLAassistant]

All committers have signed the CLA.