Initial commit of Vellum, an event photo product for guest uploads, host moderation, and original-quality galleries.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-07 19:36:14 -04:00
commit 27e2f196eb
149 changed files with 13847 additions and 0 deletions
@@ -0,0 +1,60 @@
+const WILDCARD_HOSTNAMES = new Set(["0.0.0.0", "::", "[::]"]);
+const LOCAL_HOSTNAMES = new Set([...WILDCARD_HOSTNAMES, "localhost"]);
+
+function isWildcardHostname(hostname: string) {
+  return WILDCARD_HOSTNAMES.has(hostname);
+}
+
+function isLocalHostname(hostname: string) {
+  return (
+    LOCAL_HOSTNAMES.has(hostname) ||
+    hostname === "127.0.0.1" ||
+    hostname.startsWith("127.")
+  );
+}
+
+export function resolvePublicAppOrigin(input: {
+  configuredUrl?: string;
+  authUrl?: string;
+  requestUrl?: string;
+  production: boolean;
+}) {
+  const configured = input.configuredUrl?.trim() || input.authUrl?.trim();
+  if (!configured) {
+    if (input.production) {
+      throw new Error("NEXT_PUBLIC_APP_URL is required in production");
+    }
+    if (input.requestUrl) {
+      const requestOrigin = new URL(input.requestUrl);
+      if (!isWildcardHostname(requestOrigin.hostname)) {
+        return requestOrigin.origin;
+      }
+    }
+    return "http://localhost:3000";
+  }
+
+  const url = new URL(configured);
+  if (isWildcardHostname(url.hostname)) {
+    throw new Error(
+      `NEXT_PUBLIC_APP_URL resolved to a wildcard bind address (${url.hostname})`,
+    );
+  }
+  if (
+    input.production &&
+    (url.protocol !== "https:" || isLocalHostname(url.hostname))
+  ) {
+    throw new Error(
+      "NEXT_PUBLIC_APP_URL must be a public HTTPS origin in production",
+    );
+  }
+  return url.origin;
+}
+
+export function publicAppOrigin(requestUrl?: string) {
+  return resolvePublicAppOrigin({
+    configuredUrl: process.env.NEXT_PUBLIC_APP_URL,
+    authUrl: process.env.BETTER_AUTH_URL,
+    requestUrl,
+    production: process.env.NODE_ENV === "production",
+  });
+}