Function resolveTrustedOrigins

apps/host-selfhost/src/config.ts:344–351

(webBaseUrl: string)

// previous `[webBaseUrl]` exactly and an operator who repeats it in the env var
// does not get a duplicate.
const resolveTrustedOrigins = (webBaseUrl: string): readonly string[] => {
  const additional = (process.env.EXECUTOR_TRUSTED_ORIGINS ?? "")
    .split(",")
    .map((value) => value.trim())
    .filter((value) => value.length > 0)
    .map(normalizeTrustedOrigin);
  return [...new Set([webBaseUrl, ...additional])];
};

// The org slug doubles as a URL segment (`/<slug>/policies`), so an
// operator-set value must fit the shared grammar and avoid reserved root