fix: use $env/dynamic/private in hooks.server.ts for CSRF allowlist

- ALLOWED_ORIGINS and NODE_ENV now read via $env/dynamic/private so Vite dev
  server picks them up correctly from .env
- .env.example: document ALLOWED_ORIGINS with dev IP example
- .env: add http://192.168.0.94:5173 to ALLOWED_ORIGINS for local dev

.env.example

@@ -1,7 +1,10 @@
 # Copy this to .env and fill in values for local development.
 # In production, set these as environment variables / Kubernetes secrets.
 
-# bcrypt hash of the admin password. Generate with:
+# Comma-separated list of additional allowed CORS origins.
+# Add your dev machine's IP here if accessing via IP address.
+# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
+ALLOWED_ORIGINS=
 #   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
 PASSWORD_HASH=
 

src/hooks.server.ts

@@ -1,4 +1,5 @@
 import { type Handle } from '@sveltejs/kit';
+import { env } from '$env/dynamic/private';
 
 /**
  * CSRF origin allowlist.
@@ -6,8 +7,9 @@ import { type Handle } from '@sveltejs/kit';
  * Production: set ALLOWED_ORIGINS to a comma-separated list of trusted origins.
  *   e.g. ALLOWED_ORIGINS=https://humorunits.com,https://dickloads.com
  *
- * Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV=development), localhost and
+ * Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV != production), localhost and
  * local IPs are permitted automatically so `npm run dev` works without config.
+ * Add your dev machine's IP to ALLOWED_ORIGINS in .env if accessing via IP.
  */
 function buildAllowedOrigins(): Set<string> {
   const origins = new Set<string>();
@@ -18,8 +20,8 @@ function buildAllowedOrigins(): Set<string> {
   origins.add('https://dickloads.com');
   origins.add('https://www.dickloads.com');
 
-  // Additional origins from env (e.g. staging, preview URLs)
-  const extra = process.env.ALLOWED_ORIGINS;
+  // Additional origins from env (e.g. dev IP, staging, preview URLs)
+  const extra = env.ALLOWED_ORIGINS;
   if (extra) {
     for (const o of extra.split(',')) {
       const trimmed = o.trim();
@@ -28,9 +30,8 @@ function buildAllowedOrigins(): Set<string> {
   }
 
   // In development (or when no explicit origins override is set), allow localhost
-  if (process.env.NODE_ENV !== 'production' || !extra) {
+  if (env.NODE_ENV !== 'production' || !extra) {
     origins.add('http://localhost');
-    // Allow any localhost port
     for (const port of [3000, 4173, 5173]) {
       origins.add(`http://localhost:${port}`);
     }