fix(clearfolio): allowlist attachment-view artifact origins

[cursor]

Buyer and security impact

GET /api/projects/:id/attachments/:aid/view 302-redirects the browser to a provider-returned artifact URL. After #498 bounds transport and JSON, tokenless https://cdn.example/... links were still accepted. A confused or compromised Clearfolio response could send a planner to an unreviewed host.

This child keeps the #498 transport/JSON boundary and adds the next #489 slice: credential and fragment rejection plus an explicit reviewed-origin allowlist.

What operators should do

• Keep viewing on the configured Clearfolio origin, or set CLEARFOLIO_ARTIFACT_ORIGINS to a comma-separated list of reviewed HTTPS origins such as https://cdn.example,https://files.example:8443.
• If a converted document fails to open with clearfolio artifact-link response invalid, add that reviewed origin or keep the file on the Clearfolio host. Do not disable the check at a proxy.
• Leave the setting empty to fail closed on every cross-origin artifact link.

Scope

Stacked on the current Clearfolio production-configuration parent and the #498 provider-boundary head (d4b09cdd). Unique added behavior:

• reject userinfo and fragments before returning a 302 target;
• accept cross-origin links only when the origin is listed in CLEARFOLIO_ARTIFACT_ORIGINS;
• rewrite same-origin artifactToken values into the Clearfolio viewer;
• leave allowlisted CDN tokens on that CDN (never transplant them);
• fail closed on unsafe allowlist entries with clearfolio_artifact_origins_invalid.

No database, auth/session, attachment-refresh engine, lockfile, or workflow change.

Verification

• tests/unit/clearfolio-artifact-origin.test.mjs (RED first, then GREEN)
• adapted clearfolio-status-signal CDN fixture now fails closed without an allowlist
• predecessor Clearfolio HMAC, configuration, transport, and cancellation regressions kept

Remaining #489 work

Retry/idempotency, capability readiness, persistence/lifecycle, and protected integration. This PR does not close #489.

Merge gate

Do not integrate before #493. Prefer this origin-policy child over widening #498. Do not merge on pending, skipped, or historical checks. No gate may be weakened.

  

[cursor]

Superseded by #538

This 16-file allowlist is stacked on fix/clearfolio-production-configuration, not the current provider-response parent used by #498/#504. The live origin-policy landing vehicle is #538 0c193aa28e730e5c1a18e7d740637f34efbbd95d on fix/clearfolio-provider-response-boundary.

#538 keeps the same buyer contract and tightens it: allowlist entries must equal URL.origin or that origin plus /, protocol-relative and userinfo-as-host redirects are regression-tested, and empty/whitespace env values fail closed before transport.

Do not merge this PR in parallel with #504 or #538. Do not retarget it onto develop while #498 is unmerged. Independent current-head approval on #538 is still required after exact-head checks.

View PR

  

_{Sent by Cursor Automation: Fix Issues}