Let Google sign-in trust the port the app actually uses

README.md

@@ -221,7 +221,7 @@ GOOGLE_OAUTH_CLIENT_SECRET=
 
 Then set the two that decide who gets in and from where:
 
-- `TRUSTED_ORIGINS` — where the app is served from, `http://localhost:3010` locally. It defaults to `http://localhost:3000`, which is not where `start.sh` serves the app.
+- `TRUSTED_ORIGINS` — where the app is served from. Unset, that is `http://localhost:3010`, which is where `start.sh` serves the app.
 - `INITIAL_ADMIN_EMAILS` — comma separated. An address listed here becomes an administrator the first time it signs in; everybody else becomes a user.
 
 Remove `OPENBOT_DEV_NO_AUTH`, then restart: the sign-in button is written into the app's generated config at startup, so it appears only once all four settings are present. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.

docs/configuration.md

@@ -86,7 +86,7 @@ Two things are worth knowing before pointing a deployment at any gateway. Not ev
 | `GOOGLE_OAUTH_CLIENT_SECRET` | Google OAuth client secret.                                                            |
 | `BETTER_AUTH_SECRET`         | At least 32 characters. Required with Google OAuth.                                    |
 | `BETTER_AUTH_URL`            | Public API server base URL. Required with Google OAuth.                                |
-| `TRUSTED_ORIGINS`            | Comma-separated app origins accepted by the API.                                       |
+| `TRUSTED_ORIGINS`            | Comma-separated app origins accepted by the API. Unset, `http://localhost:3010`.       |
 | `INITIAL_ADMIN_EMAILS`       | Comma-separated users seeded as administrators.                                        |
 
 Google OAuth client id and secret must be configured together. If Google OAuth is configured, `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are also required.

server/src/config.ts

@@ -218,9 +218,11 @@ function authConfig(
     baseUrl,
     secret,
     google,
+    // start.sh serves the app on 3010. A clone that enables Google sign-in without
+    // setting TRUSTED_ORIGINS must still accept the origin the app actually answers on.
     trustedOrigins: commaSeparated(environment, "TRUSTED_ORIGINS").length
       ? commaSeparated(environment, "TRUSTED_ORIGINS")
-      : ["http://localhost:3000"],
+      : ["http://localhost:3010"],
     initialAdminEmails: commaSeparated(environment, "INITIAL_ADMIN_EMAILS"),
   };
 }

server/tests/config.test.ts

@@ -137,7 +137,7 @@ describe("deployment configuration", () => {
         clientId: "google-client-id",
         clientSecret: "google-client-secret",
       },
-      trustedOrigins: ["http://localhost:3000"],
+      trustedOrigins: ["http://localhost:3010"],
       initialAdminEmails: ["admin@openbot.test", "owner@openbot.test"],
     });
   });