From 680d11e2b443ab737c13596f4297e626aeff363a Mon Sep 17 00:00:00 2001
From: fflorent <florent.git@zeteo.me>
Date: Tue, 26 Mar 2024 17:17:09 +0100
Subject: [PATCH] attempt to fix issue with duplicate doc

---
 app/common/UserAPI.ts          | 3 ++-
 app/server/lib/AppEndpoint.ts  | 7 +++++--
 app/server/lib/FlexServer.ts   | 5 +++--
 app/server/lib/requestUtils.ts | 8 ++++++++
 4 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/app/common/UserAPI.ts b/app/common/UserAPI.ts
index eb3c708881..2c9dde7186 100644
--- a/app/common/UserAPI.ts
+++ b/app/common/UserAPI.ts
@@ -1123,6 +1123,7 @@ export class DocAPIImpl extends BaseAPI implements DocAPI {
  */
 export function getDocWorkerUrl(homeUrl: string, docWorkerInfo: {
   docWorkerUrl: string|null,
+  internalDocWorkerUrl: string|null,
   selfPrefix?: string,
 }): string {
   if (!docWorkerInfo.docWorkerUrl) {
@@ -1134,5 +1135,5 @@ export function getDocWorkerUrl(homeUrl: string, docWorkerInfo: {
     url.pathname = docWorkerInfo.selfPrefix + url.pathname;
     return url.href;
   }
-  return docWorkerInfo.docWorkerUrl;
+  return docWorkerInfo.internalDocWorkerUrl || docWorkerInfo.docWorkerUrl;
 }
diff --git a/app/server/lib/AppEndpoint.ts b/app/server/lib/AppEndpoint.ts
index 05fd54e14f..e3e912a1d2 100644
--- a/app/server/lib/AppEndpoint.ts
+++ b/app/server/lib/AppEndpoint.ts
@@ -59,7 +59,7 @@ export function attachAppEndpoint(options: AttachOptions): void {
       // Alternatives could be: have the client to send their base URL
       // in the request; or use headers commonly added by reverse proxies.
       const selfPrefix =  "/dw/self/v/" + gristServer.getTag();
-      res.json({docWorkerUrl: null, selfPrefix});
+      res.json({docWorkerUrl: null, internalDocWorkerUrl: null, selfPrefix});
       return;
     }
     if (!trustOrigin(req, res)) { throw new Error('Unrecognized origin'); }
@@ -73,7 +73,10 @@ export function attachAppEndpoint(options: AttachOptions): void {
     if (!docStatus) {
       return res.status(500).json({error: 'no worker'});
     }
-    res.json({docWorkerUrl: customizeDocWorkerUrl(docStatus.docWorker.publicUrl, req)});
+    res.json({
+      docWorkerUrl: customizeDocWorkerUrl(docStatus.docWorker.publicUrl, req),
+      internalDocWorkerUrl: docStatus.docWorker.internalUrl
+    });
   }));
 
   // Handler for serving the document landing pages.  Expects the following parameters:
diff --git a/app/server/lib/FlexServer.ts b/app/server/lib/FlexServer.ts
index 41288c4b2a..24f583c633 100644
--- a/app/server/lib/FlexServer.ts
+++ b/app/server/lib/FlexServer.ts
@@ -312,8 +312,9 @@ export class FlexServer implements GristServer {
   /**
    * Same as getHomeUrl, but for requesting internally.
    */
-  public getHomeInternalUrl(req: express.Request, relPath?: string): string {
-    return this.getHomeUrl(req, relPath, this.getDefaultHomeInternalUrl());
+  public getHomeInternalUrl(req: express.Request, relPath: string = ''): string {
+    const homeUrl = new URL(relPath, this.getDefaultHomeInternalUrl());
+    return homeUrl.href;
   }
 
   /**
diff --git a/app/server/lib/requestUtils.ts b/app/server/lib/requestUtils.ts
index e25cef581c..cbe9ba73a5 100644
--- a/app/server/lib/requestUtils.ts
+++ b/app/server/lib/requestUtils.ts
@@ -86,6 +86,14 @@ export function trustOrigin(req: Request, resp: Response): boolean {
   const origin = req.get('origin');
   if (!origin) { return true; } // Not a CORS request.
   if (process.env.GRIST_HOST && req.hostname === process.env.GRIST_HOST) { return true; }
+
+  if (
+    (process.env.APP_HOME_INTERNAL_URL && req.hostname === new URL(process.env.APP_HOME_INTERNAL_URL).hostname) ||
+    (process.env.APP_DOC_INTERNAL_URL && req.hostname === new URL(process.env.APP_DOC_INTERNAL_URL).hostname)
+  ) {
+    return true;
+  }
+
   if (!allowHost(req, new URL(origin))) { return false; }
 
   // For a request to a custom domain, the full hostname must match.