refactor: rework scheme validation in oauth controller and frontend (#1026)

internal/controller/oauth_controller.go

@@ -331,8 +331,7 @@ func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
 
 	controller.log.App.Debug().Err(err).Msg("Failed to validate redirect URI")
 
-	if errors.Is(err, validators.ErrInvalidURL) ||
-		errors.Is(err, validators.ErrPortMismatch) {
+	if !errors.Is(err, validators.ErrHostnameMismatch) {
 		return false
 	}
 

internal/controller/oauth_controller_test.go

@@ -81,14 +81,6 @@ func TestOAuthController_isRedirectSafe(t *testing.T) {
 			redirectURI:       "https://sub.example.com",
 			expected:          false,
 		},
-		{
-			description:       "Different scheme returns false",
-			appURL:            "https://tinyauth.example.com",
-			cookieDomain:      "example.com",
-			subdomainsEnabled: true,
-			redirectURI:       "http://tinyauth.example.com",
-			expected:          false,
-		},
 		{
 			description:       "Different port returns false",
 			appURL:            "https://tinyauth.example.com",

internal/service/access_controls_service.go

@@ -50,9 +50,7 @@ func (service *AccessControlsService) lookupStaticACLs(domain string) *model.App
 				service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
 				return &config
 			}
-			if !errors.Is(err, validators.ErrHostnameMismatch) &&
-				!errors.Is(err, validators.ErrPortMismatch) &&
-				!errors.Is(err, validators.ErrSchemeMismatch) {
+			if !errors.Is(err, validators.ErrHostnameMismatch) {
 				service.log.App.Debug().Str("name", app).Err(err).Msg("Domain validation failed")
 			}
 		}