# Local 403 fix for the web profile.
# Official dsh pins privileged /api methods (settings, credentials, presets,
# host dialogs, llm.discoverModels) to loopback by re-checking them with an
# empty trusted-host list. That makes a reverse-proxied /api always return 403
# even when --trusted-host lists the public host.
#
# This bundle inserts one row that registers exact /api/<method> routes for
# those methods and validates them against the same webRuntime.trustedHosts
# list the rest of /api uses, so a host listed in --trusted-host can call them.
#
# trustedHosts keeps the official webRuntime expression, so
# `dsh web --trusted-host <authority>` still feeds this fence.
- insert:
    - id: local-403-fix
      name: dsh-local-403-fix
      inject: [webRuntime]
      config:
        trustedHosts: !!js ctx.webRuntime.trustedHosts