| 119 | // 3. unset + Host missing/disallowed: caller wrapped function |
| 120 | // rejects with 421 before reaching here. |
| 121 | const resolveResourceUrl = (req: Request): string | null => { |
| 122 | if (opts.publicUrl) { |
| 123 | return opts.publicUrl.replace(/\/+$/, ""); |
| 124 | } |
| 125 | const host = req.headers.host; |
| 126 | if (!host) return null; |
| 127 | const bare = host.split(":")[0]!.toLowerCase(); |
| 128 | if (!allowedHosts.has(bare)) return null; |
| 129 | return `https://${host}`; |
| 130 | }; |
| 131 | |
| 132 | app.get("/.well-known/oauth-protected-resource", (req, res) => { |
| 133 | const resource = resolveResourceUrl(req); |