fix(auth): accept configured public origin for sign-in

backend/app/main.py

@@ -60,6 +60,7 @@ from .runtime import get_runtime_settings
 from .metrics import record_api, start_metrics
 from .request_limits import InstallationBodyLimitMiddleware
 from .secret_storage import validate_secret_storage_configuration
+from .services.request_origins import is_allowed_request_origin
 
 logger = logging.getLogger(__name__)
 _background_tasks: list[asyncio.Task[None]] = []
@@ -112,9 +113,8 @@ async def log_requests_and_add_security_headers(request: Request, call_next):
         )
     request.state.request_id = request_id
     if request.method.upper() not in {"GET", "HEAD", "OPTIONS"}:
-        origin = str(request.headers.get("origin") or "").rstrip("/")
-        allowed_origin = str(settings.cors_allow_origin or "").rstrip("/")
-        if origin and origin != allowed_origin:
+        origin = str(request.headers.get("origin") or "")
+        if origin and not is_allowed_request_origin(origin):
             record_api(request, 403, 0.0)
             if operation_id and operation_token is not None:
                 finish_operation(operation_id, success=False, status_code=403)