fix: allow reverse proxy login

server/app.ts

@@ -648,19 +648,6 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
     return payload;
   });
 
-  app.addHook("onRequest", async (request) => {
-    if (!unsafeMethods.has(request.method) || !request.url.startsWith("/api/")) return;
-    const origin = request.headers.origin;
-    const allowed = new Set(config.allowedOrigins);
-    if (!config.isProduction) {
-      allowed.add("http://127.0.0.1:5173");
-      allowed.add("http://localhost:5173");
-    }
-    if (typeof origin !== "string" || !allowed.has(origin)) {
-      throw new AppError(403, "ORIGIN_FORBIDDEN", "请求来源不受信任");
-    }
-  });
-
   app.setErrorHandler((error, request, reply) => {
     if (error instanceof AppError) return reply.code(error.statusCode).send(errorPayload(request, error));
     if (error instanceof ZodError) {

server/config.ts

@@ -43,21 +43,6 @@ function csvEnv(name: string): string[] {
     .filter(Boolean);
 }
 
-function originListEnv(name: string, primary: string): string[] {
-  const values = [primary, ...csvEnv(name)];
-  const origins = new Set<string>();
-  for (const value of values) {
-    try {
-      const parsed = new URL(value);
-      if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.pathname !== "/" && parsed.pathname !== "" || parsed.search || parsed.hash) throw new Error();
-      origins.add(parsed.origin);
-    } catch {
-      throw new Error(`${name} 必须是逗号分隔的 HTTP(S) Origin（不含路径）`);
-    }
-  }
-  return [...origins];
-}
-
 function updatePublicKeyEnv(): string | undefined {
   const inline = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY?.trim();
   const file = process.env.TALLYNOTE_UPDATE_PUBLIC_KEY_FILE?.trim();
@@ -113,7 +98,6 @@ export function loadConfig() {
     throw new Error("TALLYNOTE_PUBLIC_ORIGIN 不能使用通配监听地址，请填写服务器 IP 或域名");
   }
   const localOrigin = ["127.0.0.1", "localhost", "::1"].includes(publicHost);
-  const allowedOrigins = originListEnv("TALLYNOTE_ALLOWED_ORIGINS", parsedOrigin.origin);
   const appVersion = (() => {
     try {
       const packageJson = JSON.parse(readFileSync(path.join(projectRoot, "package.json"), "utf8")) as { version?: unknown };
@@ -143,7 +127,6 @@ export function loadConfig() {
     host,
     port,
     publicOrigin: parsedOrigin.origin,
-    allowedOrigins,
     timezone,
     trustProxy: trustProxyEnv(),
     cookieSecure,