fix: auto-trust private/LAN IPs for Better Auth origin validation (#312)

[MarlBurroW]

Description

Fixes the "Invalid origin" error that prevents login when accessing KinBot from a LAN IP address (e.g. http://192.168.178.43:3000), which is a common scenario for Docker users on NAS devices and home servers.

Root cause

Better Auth validates the Origin header of incoming requests against a configured trustedOrigins list. Previously, this list only included:

• config.publicUrl (defaults to http://localhost:3333)
• Hardcoded localhost / 127.0.0.1 entries on ports 5173, 5174, 3000

When a user accesses KinBot via their NAS/server's LAN IP (e.g. http://192.168.178.43:3000), the origin doesn't match any trusted origin, causing ERROR [Better Auth]: Invalid origin: http://192.168.178.43:3000.

Fix

When TRUSTED_ORIGINS is not explicitly set, we now use a dynamic function (supported by Better Auth) that:

1. Always trusts the static origins (publicUrl + dev servers)
2. Auto-trusts any origin from a private/loopback IP — covers RFC 1918 ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), loopback (127.x.x.x, ::1), link-local (169.254.x.x, fe80::, fd..), and localhost

This is safe because KinBot is a self-hosted tool and private network origins should always be trusted. Users who set TRUSTED_ORIGINS explicitly still get the exact list they configured (no behavior change).

Changes

• src/server/auth/index.ts: Added isPrivateHost() helper and buildTrustedOrigins() function that dynamically trusts private IPs
• docker/docker-compose.yml: Improved comments about PUBLIC_URL to clarify that LAN IPs are auto-trusted for auth

Closes #312

Type of Change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / Build
• Tests
• Breaking change

How to Test

1. Run KinBot in Docker without setting PUBLIC_URL or TRUSTED_ORIGINS
2. Access KinBot from another device on the LAN via the host's IP (e.g. http://192.168.x.x:3000)
3. Login should work without "Invalid origin" errors

• Manual testing
• Unit tests
• E2E tests

Checklist

• I've read the Contributing Guide
• I've tested this locally
• New code follows existing patterns and conventions
• No hardcoded colors
• Shared types in src/shared/types.ts

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a1bd0a1.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None