feat(controlplane): configurable extra allowed origins for the login callback
The control plane validates the post-login callback URL against a fixed list of origins: the login URL, the control plane external URL and the dashboard UI URL (plus relative paths and loopback hosts). A deployment that runs another trusted service as the callback target had no way to allow it.
This adds an allowed_callback_origins setting to the control plane config, a list of additional origins that the OIDC login callback may redirect to. The validation stays strict:
- Each entry must be a plain
http(s)://host[:port]origin. Paths, queries, fragments, user info and wildcards are rejected. - A malformed entry fails the control plane at start up with an error that names it.
- Origins are compared exactly on scheme, host and port (case-insensitive host), never by prefix.
- An empty or unset list keeps today's behavior.
The Helm chart exposes it as controlplane.allowedCallbackOrigins and renders it into the control plane configmap. The README parameters table is updated and the chart patch version is bumped.
The field is a top-level config setting next to ui_dashboard_url, not under auth. The chart renders the auth section from a Secret, and this value is not sensitive, so it belongs in the configmap like the dashboard URL.
Testing: table-driven unit tests for the origin parsing (valid, port, trailing slash, case, empty, malformed, missing scheme, non-http scheme, wildcard, path, query, fragment, user info) and for the callback check with extra origins (exact match, different port, default port, different scheme, host prefix, port prefix, user-info trick, empty list). Ran helm template with and without the value.
This change was written with AI assistance (Claude Code).
š¤ Opened by the eng-autopilot skill (Claude Code) for @migmartri