Add tenant.AllowedSchemes advanced configuration item (#1332)

nabijaczleweli · web-flow · commit a978d2ca6cb9 · 2025-07-19T11:04:00.000+01:00
* Add tenant.AllowedSchemes advanced configuration item Specifying ^monero:[48] or ^bitcoin:(1|3|bc1) allows cryptocurrency payment links These were rendered but then sanitised away to <a>...</a> w/o href= Ref: https://bounties.monero.social/posts/15/1-200m-monero-bounties-site-parse-donation-address-as-link * Ship the config via useFider() * Work around useContext() restrixion in test * Disable allowed schemes by setting ALLOW_ALLOWED_SCHEMES=false * Hide Allowed URL Schemes config if disabled * Bump migration date
diff --git a/.example.env b/.example.env
@@ -2,6 +2,7 @@ BASE_URL=http://localhost:3000
 GO_ENV=development
 DATABASE_URL=postgres://fider:fider_pw@localhost:5555/fider?sslmode=disable
 JWT_SECRET=hsjl]W;&ZcHxT&FK;s%bgIQF:#ch=~#Al4:5]N;7V<qPZ3e9lT4'%;go;LIkc%k
+# ALLOW_ALLOWED_SCHEMES=false
 
 LOG_LEVEL=DEBUG
 LOG_CONSOLE=true
diff --git a/app/actions/tenant.go b/app/actions/tenant.go
@@ -177,7 +177,8 @@ func (action *UpdateTenantSettings) Validate(ctx context.Context, user *entity.U
 
 // UpdateTenantAdvancedSettings is the input model used to update tenant advanced settings
 type UpdateTenantAdvancedSettings struct {
-	CustomCSS string `json:"customCSS"`
+	CustomCSS      string `json:"customCSS"`
+	AllowedSchemes string `json:"allowedSchemes"`
 }
 
 // IsAuthorized returns true if current user is authorized to perform this action
diff --git a/app/handlers/admin.go b/app/handlers/admin.go
@@ -32,6 +32,7 @@ func AdvancedSettingsPage() web.HandlerFunc {
 			Title: "Advanced · Site Settings",
 			Data: web.Map{
 				"customCSS": c.Tenant().CustomCSS,
+				"allowedSchemes": c.Tenant().AllowedSchemes,
 			},
 		})
 	}
@@ -84,6 +85,7 @@ func UpdateAdvancedSettings() web.HandlerFunc {
 
 		if err := bus.Dispatch(c, &cmd.UpdateTenantAdvancedSettings{
 			CustomCSS: action.CustomCSS,
+			AllowedSchemes: action.AllowedSchemes,
 		}); err != nil {
 			return c.Failure(err)
 		}
diff --git a/app/models/cmd/tenant.go b/app/models/cmd/tenant.go
@@ -35,7 +35,8 @@ type UpdateTenantSettings struct {
 }
 
 type UpdateTenantAdvancedSettings struct {
-	CustomCSS string
+	CustomCSS      string
+	AllowedSchemes string
 }
 
 type ActivateTenant struct {
diff --git a/app/models/entity/tenant.go b/app/models/entity/tenant.go
@@ -15,6 +15,7 @@ type Tenant struct {
 	IsPrivate          bool              `json:"isPrivate"`
 	LogoBlobKey        string            `json:"logoBlobKey"`
 	CustomCSS          string            `json:"-"`
+	AllowedSchemes     string            `json:"allowedSchemes"`
 	IsEmailAuthAllowed bool              `json:"isEmailAuthAllowed"`
 	IsFeedEnabled      bool              `json:"isFeedEnabled"`
 	PreventIndexing    bool              `json:"preventIndexing"`
diff --git a/app/pkg/env/env.go b/app/pkg/env/env.go
@@ -54,6 +54,7 @@ type config struct {
 	Locale                      string `env:"LOCALE,default=en"`
 	JWTSecret                   string `env:"JWT_SECRET,required"`
 	PostCreationWithTagsEnabled bool   `env:"POST_CREATION_WITH_TAGS_ENABLED,default=false"`
+	AllowAllowedSchemes         bool   `env:"ALLOW_ALLOWED_SCHEMES,default=true"`
 	Paddle                      struct {
 		IsSandbox      bool   `env:"PADDLE_SANDBOX,default=false"`
 		VendorID       string `env:"PADDLE_VENDOR_ID"`
diff --git a/app/pkg/web/renderer.go b/app/pkg/web/renderer.go
@@ -204,18 +204,19 @@ func (r *Renderer) Render(w io.Writer, statusCode int, props Props, ctx *Context
 	public["tenant"] = tenant
 	public["props"] = props.Data
 	public["settings"] = &Map{
-		"mode":             env.Config.HostMode,
-		"locale":           locale,
-		"localeDirection":  localeDirection,
-		"environment":      env.Config.Environment,
-		"googleAnalytics":  env.Config.GoogleAnalytics,
-		"domain":           env.MultiTenantDomain(),
-		"hasLegal":         env.HasLegal(),
-		"isBillingEnabled": env.IsBillingEnabled(),
-		"baseURL":          ctx.BaseURL(),
-		"assetsURL":        AssetsURL(ctx, ""),
-		"oauth":            oauthProviders.Result,
-		"postWithTags":     env.Config.PostCreationWithTagsEnabled,
+		"mode":                env.Config.HostMode,
+		"locale":              locale,
+		"localeDirection":     localeDirection,
+		"environment":         env.Config.Environment,
+		"googleAnalytics":     env.Config.GoogleAnalytics,
+		"domain":              env.MultiTenantDomain(),
+		"hasLegal":            env.HasLegal(),
+		"isBillingEnabled":    env.IsBillingEnabled(),
+		"baseURL":             ctx.BaseURL(),
+		"assetsURL":           AssetsURL(ctx, ""),
+		"oauth":               oauthProviders.Result,
+		"postWithTags":        env.Config.PostCreationWithTagsEnabled,
+		"allowAllowedSchemes": env.Config.AllowAllowedSchemes,
 	}
 
 	if ctx.IsAuthenticated() {
diff --git a/app/pkg/web/testdata/basic.html b/app/pkg/web/testdata/basic.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
+  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/canonical.html b/app/pkg/web/testdata/canonical.html
@@ -47,7 +47,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
+  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/chunk.html b/app/pkg/web/testdata/chunk.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","page":"Test.page","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
+  {"contextID":"CONTEXT_ID","page":"Test.page","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"Fider"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/home.html b/app/pkg/web/testdata/home.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"","props":{"countPerStatus":{},"posts":[],"tags":[]},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"My Page Title · Fider"}
+  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"","props":{"countPerStatus":{},"posts":[],"tags":[]},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"My Page Title · Fider"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/home_ssr.html b/app/pkg/web/testdata/home_ssr.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"Test.page","props":{"countPerStatus":{},"posts":[],"tags":[]},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":{"id":0,"name":"","subdomain":"","invitation":"","welcomeMessage":"","cname":"","status":0,"locale":"en","isPrivate":false,"logoBlobKey":"","isEmailAuthAllowed":false,"isFeedEnabled":false,"preventIndexing":false},"title":"My Page Title · "}
+  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"Test.page","props":{"countPerStatus":{},"posts":[],"tags":[]},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":{"id":0,"name":"","subdomain":"","invitation":"","welcomeMessage":"","cname":"","status":0,"locale":"en","isPrivate":false,"logoBlobKey":"","allowedSchemes":"","isEmailAuthAllowed":false,"isFeedEnabled":false,"preventIndexing":false},"title":"My Page Title · "}
 
   </script>
 
diff --git a/app/pkg/web/testdata/oauth.html b/app/pkg/web/testdata/oauth.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[{"provider":"google","displayName":"Google","clientID":"1234","url":"https://demo.test.fider.io:3000/oauth/google","callbackURL":"https://demo.test.fider.io:3000/oauth/google/callback","logoBlobKey":"google.png","isCustomProvider":false,"isEnabled":true}],"postWithTags":true},"tenant":null,"title":"Fider"}
+  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[{"provider":"google","displayName":"Google","clientID":"1234","url":"https://demo.test.fider.io:3000/oauth/google","callbackURL":"https://demo.test.fider.io:3000/oauth/google/callback","logoBlobKey":"google.png","isCustomProvider":false,"isEnabled":true}],"postWithTags":true},"tenant":null,"title":"Fider"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/tenant.html b/app/pkg/web/testdata/tenant.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":{"id":0,"name":"Game of Thrones","subdomain":"","invitation":"","welcomeMessage":"","cname":"","status":0,"locale":"","isPrivate":false,"logoBlobKey":"","isEmailAuthAllowed":false,"isFeedEnabled":false,"preventIndexing":false},"title":"Game of Thrones"}
+  {"contextID":"CONTEXT_ID","page":"","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":{"id":0,"name":"Game of Thrones","subdomain":"","invitation":"","welcomeMessage":"","cname":"","status":0,"locale":"","isPrivate":false,"logoBlobKey":"","allowedSchemes":"","isEmailAuthAllowed":false,"isFeedEnabled":false,"preventIndexing":false},"title":"Game of Thrones"}
 
   </script>
 
diff --git a/app/pkg/web/testdata/user.html b/app/pkg/web/testdata/user.html
@@ -45,7 +45,7 @@ <h2 class="text-display2">Please enable JavaScript</h2>
 
   <script id="server-data" type="application/json">
      
-  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"","props":{},"sessionID":"","settings":{"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"My Page Title · Fider","user":{"avatarBlobKey":"","avatarType":"gravatar","avatarURL":"https://demo.test.fider.io:3000/static/avatars/gravatar/5/Jon%20Snow","email":"jon.snow@got.com","id":5,"isAdministrator":true,"isCollaborator":true,"name":"Jon Snow","role":"administrator","status":"active"}}
+  {"contextID":"CONTEXT_ID","description":"My Page Description","page":"","props":{},"sessionID":"","settings":{"allowAllowedSchemes":true,"assetsURL":"https://demo.test.fider.io:3000","baseURL":"https://demo.test.fider.io:3000","domain":".test.fider.io","environment":"test","googleAnalytics":"","hasLegal":true,"isBillingEnabled":false,"locale":"en","localeDirection":"ltr","mode":"multi","oauth":[],"postWithTags":true},"tenant":null,"title":"My Page Title · Fider","user":{"avatarBlobKey":"","avatarType":"gravatar","avatarURL":"https://demo.test.fider.io:3000/static/avatars/gravatar/5/Jon%20Snow","email":"jon.snow@got.com","id":5,"isAdministrator":true,"isCollaborator":true,"name":"Jon Snow","role":"administrator","status":"active"}}
 
   </script>
 
diff --git a/app/services/sqlstore/postgres/tenant.go b/app/services/sqlstore/postgres/tenant.go
@@ -28,6 +28,7 @@ type dbTenant struct {
 	IsPrivate          bool   `db:"is_private"`
 	LogoBlobKey        string `db:"logo_bkey"`
 	CustomCSS          string `db:"custom_css"`
+	AllowedSchemes     string `db:"allowed_schemes"`
 	IsEmailAuthAllowed bool   `db:"is_email_auth_allowed"`
 	IsFeedEnabled      bool   `db:"is_feed_enabled"`
 	PreventIndexing    bool   `db:"prevent_indexing"`
@@ -50,6 +51,7 @@ func (t *dbTenant) toModel() *entity.Tenant {
 		IsPrivate:          t.IsPrivate,
 		LogoBlobKey:        t.LogoBlobKey,
 		CustomCSS:          t.CustomCSS,
+		AllowedSchemes:     t.AllowedSchemes,
 		IsEmailAuthAllowed: t.IsEmailAuthAllowed,
 		IsFeedEnabled:      t.IsFeedEnabled,
 		PreventIndexing:    t.PreventIndexing,
@@ -168,13 +170,19 @@ func updateTenantSettings(ctx context.Context, c *cmd.UpdateTenantSettings) erro
 
 func updateTenantAdvancedSettings(ctx context.Context, c *cmd.UpdateTenantAdvancedSettings) error {
 	return using(ctx, func(trx *dbx.Trx, tenant *entity.Tenant, user *entity.User) error {
-		query := "UPDATE tenants SET custom_css = $1 WHERE id = $2"
-		_, err := trx.Execute(query, c.CustomCSS, tenant.ID)
+		AllowedSchemes := c.AllowedSchemes
+		if !env.Config.AllowAllowedSchemes {
+			AllowedSchemes = ""
+		}
+
+		query := "UPDATE tenants SET custom_css = $1, allowed_schemes = $2 WHERE id = $3"
+		_, err := trx.Execute(query, c.CustomCSS, AllowedSchemes, tenant.ID)
 		if err != nil {
 			return errors.Wrap(err, "failed update tenant advanced settings")
 		}
 
 		tenant.CustomCSS = c.CustomCSS
+		tenant.AllowedSchemes = AllowedSchemes
 		return nil
 	})
 }
@@ -238,8 +246,8 @@ func createTenant(ctx context.Context, c *cmd.CreateTenant) error {
 
 		var id int
 		err := trx.Get(&id,
-			`INSERT INTO tenants (name, subdomain, created_at, cname, invitation, welcome_message, status, is_private, custom_css, logo_bkey, locale, is_email_auth_allowed, is_feed_enabled, prevent_indexing) 
-			 VALUES ($1, $2, $3, '', '', '', $4, false, '', '', $5, true, true, true) 
+			`INSERT INTO tenants (name, subdomain, created_at, cname, invitation, welcome_message, status, is_private, custom_css, logo_bkey, locale, is_email_auth_allowed, is_feed_enabled, prevent_indexing)
+			 VALUES ($1, $2, $3, '', '', '', $4, false, '', '', $5, true, true, true)
 			 RETURNING id`, c.Name, c.Subdomain, now, c.Status, env.Config.Locale)
 		if err != nil {
 			return err
@@ -248,7 +256,7 @@ func createTenant(ctx context.Context, c *cmd.CreateTenant) error {
 		if env.IsBillingEnabled() {
 			trialEndsAt := time.Now().AddDate(0, 0, 15) // 15 days
 			_, err := trx.Execute(
-				`INSERT INTO tenants_billing (tenant_id, trial_ends_at, status, paddle_subscription_id, paddle_plan_id) 
+				`INSERT INTO tenants_billing (tenant_id, trial_ends_at, status, paddle_subscription_id, paddle_plan_id)
 				 VALUES ($1, $2, $3, '', '')`, id, trialEndsAt, enum.BillingTrial)
 			if err != nil {
 				return err
@@ -267,7 +275,7 @@ func getFirstTenant(ctx context.Context, q *query.GetFirstTenant) error {
 		tenant := dbTenant{}
 
 		err := trx.Get(&tenant, `
-			SELECT id, name, subdomain, cname, invitation, locale, welcome_message, status, is_private, logo_bkey, custom_css, is_email_auth_allowed, is_feed_enabled, prevent_indexing
+			SELECT id, name, subdomain, cname, invitation, locale, welcome_message, status, is_private, logo_bkey, custom_css, allowed_schemes, is_email_auth_allowed, is_feed_enabled, prevent_indexing
 			FROM tenants
 			ORDER BY id LIMIT 1
 		`)
@@ -286,9 +294,9 @@ func getTenantByDomain(ctx context.Context, q *query.GetTenantByDomain) error {
 		tenant := dbTenant{}
 
 		err := trx.Get(&tenant, `
-			SELECT id, name, subdomain, cname, invitation, locale, welcome_message, status, is_private, logo_bkey, custom_css, is_email_auth_allowed, is_feed_enabled, prevent_indexing
+			SELECT id, name, subdomain, cname, invitation, locale, welcome_message, status, is_private, logo_bkey, custom_css, allowed_schemes, is_email_auth_allowed, is_feed_enabled, prevent_indexing
 			FROM tenants t
-			WHERE subdomain = $1 OR subdomain = $2 OR cname = $3 
+			WHERE subdomain = $1 OR subdomain = $2 OR cname = $3
 			ORDER BY cname DESC
 		`, env.Subdomain(q.Domain), q.Domain, q.Domain)
 		if err != nil {
diff --git a/app/services/sqlstore/postgres/tenant_test.go b/app/services/sqlstore/postgres/tenant_test.go
@@ -223,13 +223,15 @@ func TestTenantStorage_AdvancedSettings(t *testing.T) {
 
 	err := bus.Dispatch(demoTenantCtx, &cmd.UpdateTenantAdvancedSettings{
 		CustomCSS: ".primary { color: red; }",
+		AllowedSchemes: "^monero:[48]\n^bitcoin:(1|3|bc1)",
 	})
 	Expect(err).IsNil()
 
 	getByDomain := &query.GetTenantByDomain{Domain: "demo"}
 	err = bus.Dispatch(demoTenantCtx, getByDomain)
 	Expect(err).IsNil()
 	Expect(getByDomain.Result.CustomCSS).Equals(".primary { color: red; }")
+	Expect(getByDomain.Result.AllowedSchemes).Equals("^monero:[48]\n^bitcoin:(1|3|bc1)")
 }
 
 func TestTenantStorage_SaveFindSet_VerificationKey(t *testing.T) {
diff --git a/migrations/202507161200_add_allowed_schemes.sql b/migrations/202507161200_add_allowed_schemes.sql
@@ -0,0 +1 @@
+ALTER TABLE tenants ADD allowed_schemes TEXT NOT NULL DEFAULT '';
diff --git a/public/hooks/use-fider.ts b/public/hooks/use-fider.ts
@@ -2,3 +2,5 @@ import { useContext } from "react"
 import { FiderContext } from "@fider/services"
 
 export const useFider = () => useContext(FiderContext)
+// useContext() doesn't work in tests
+export const fiderAllowedSchemes = { get: () => useFider().session.tenant.allowedSchemes }
diff --git a/public/models/identity.ts b/public/models/identity.ts
@@ -9,6 +9,7 @@ export interface Tenant {
   status: TenantStatus
   isPrivate: boolean
   logoBlobKey: string
+  allowedSchemes: string
   isEmailAuthAllowed: boolean
   isFeedEnabled: boolean
 }
diff --git a/public/models/settings.ts b/public/models/settings.ts
@@ -21,6 +21,7 @@ export interface SystemSettings {
   assetsURL: string
   oauth: OAuthProviderOption[]
   postWithTags: boolean
+  allowAllowedSchemes: boolean
 }
 
 export interface UserSettings {
diff --git a/public/pages/Administration/pages/AdvancedSettings.page.tsx b/public/pages/Administration/pages/AdvancedSettings.page.tsx
diff --git a/public/services/actions/tenant.ts b/public/services/actions/tenant.ts
diff --git a/public/services/markdown.spec.ts b/public/services/markdown.spec.ts
diff --git a/public/services/markdown.ts b/public/services/markdown.ts

Original file line number	Diff line number	Diff line change
`@@ -177,7 +177,8 @@ func (action UpdateTenantSettings) Validate(ctx context.Context, user entity.U`
`177`	`177`
`178`	`178`	`// UpdateTenantAdvancedSettings is the input model used to update tenant advanced settings`
`179`	`179`	`type UpdateTenantAdvancedSettings struct {`
`180`		- CustomCSS string `json:"customCSS"`
	`180`	+ CustomCSS string `json:"customCSS"`
	`181`	+ AllowedSchemes string `json:"allowedSchemes"`
`181`	`182`	`}`
`182`	`183`
`183`	`184`	`// IsAuthorized returns true if current user is authorized to perform this action`
Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,7 @@ func AdvancedSettingsPage() web.HandlerFunc {`
`32`	`32`	`Title: "Advanced · Site Settings",`
`33`	`33`	`Data: web.Map{`
`34`	`34`	`"customCSS": c.Tenant().CustomCSS,`
	`35`	`+ "allowedSchemes": c.Tenant().AllowedSchemes,`
`35`	`36`	`},`
`36`	`37`	`})`
`37`	`38`	`}`
`@@ -84,6 +85,7 @@ func UpdateAdvancedSettings() web.HandlerFunc {`
`84`	`85`
`85`	`86`	`if err := bus.Dispatch(c, &cmd.UpdateTenantAdvancedSettings{`
`86`	`87`	`CustomCSS: action.CustomCSS,`
	`88`	`+ AllowedSchemes: action.AllowedSchemes,`
`87`	`89`	`}); err != nil {`
`88`	`90`	`return c.Failure(err)`
`89`	`91`	`}`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,8 @@ type UpdateTenantSettings struct {`
`35`	`35`	`}`
`36`	`36`
`37`	`37`	`type UpdateTenantAdvancedSettings struct {`
`38`		`- CustomCSS string`
	`38`	`+ CustomCSS string`
	`39`	`+ AllowedSchemes string`
`39`	`40`	`}`
`40`	`41`
`41`	`42`	`type ActivateTenant struct {`