fix: support proxied origins and update progress

server/config.ts

@@ -43,6 +43,21 @@ function csvEnv(name: string): string[] {
     .filter(Boolean);
 }
 
+function originListEnv(name: string, primary: string): string[] {
+  const values = [primary, ...csvEnv(name)];
+  const origins = new Set<string>();
+  for (const value of values) {
+    try {
+      const parsed = new URL(value);
+      if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.pathname !== "/" && parsed.pathname !== "" || parsed.search || parsed.hash) throw new Error();
+      origins.add(parsed.origin);
+    } catch {
+      throw new Error(`${name} 必须是逗号分隔的 HTTP(S) Origin（不含路径）`);
+    }
+  }
+  return [...origins];
+}
+
 function updatePublicKeyEnv(): string | undefined {
   const inline = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY?.trim();
   const file = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY_FILE?.trim();
@@ -98,6 +113,7 @@ export function loadConfig() {
     throw new Error("TALLYNOTE_PUBLIC_ORIGIN 不能使用通配监听地址，请填写服务器 IP 或域名");
   }
   const localOrigin = ["127.0.0.1", "localhost", "::1"].includes(publicHost);
+  const allowedOrigins = originListEnv("TALLYNOTE_ALLOWED_ORIGINS", parsedOrigin.origin);
   const appVersion = (() => {
     try {
       const packageJson = JSON.parse(readFileSync(path.join(projectRoot, "package.json"), "utf8")) as { version?: unknown };
@@ -127,6 +143,7 @@ export function loadConfig() {
     host,
     port,
     publicOrigin: parsedOrigin.origin,
+    allowedOrigins,
     timezone,
     trustProxy: trustProxyEnv(),
     cookieSecure,