fix(server): device screenshots no longer fail with 403 over Tailscale

apps/server/src/device/DeviceHubProxy.test.ts

@@ -25,9 +25,11 @@ const fixture = (
 ) => {
   let finalized = 0;
   const requests: string[] = [];
+  const headers: Array<Record<string, string>> = [];
   const client = HttpClient.make((request, _url, signal) =>
     Effect.gen(function* () {
       requests.push(request.url);
+      headers.push(request.headers);
       signal.addEventListener("abort", () => {
         finalized++;
       });
@@ -61,7 +63,7 @@ const fixture = (
     { disableLogger: true },
   );
   disposers.push(dispose);
-  return { handler, requests, finalized: () => finalized };
+  return { handler, requests, headers, finalized: () => finalized };
 };
 
 describe("device hub proxy", () => {
@@ -131,6 +133,24 @@ describe("device hub proxy", () => {
     ]);
   });
 
+  it("presents a remote browser's screenshot to the hub as a same-origin loopback request", async () => {
+    const { handler, headers } = fixture([AuthOrchestrationReadScope]);
+    const response = await handler(
+      new Request(
+        "http://t3.test/api/device-hub/vendor/serve-emu/api/screenshot?device=emulator-5554",
+        {
+          method: "POST",
+          headers: { origin: "https://devbox.tailnet.ts.net", "x-forwarded-proto": "https" },
+        },
+      ),
+    );
+    expect(response.status).toBe(200);
+    await response.text();
+    expect(headers).toHaveLength(1);
+    expect(headers[0]).toMatchObject({ origin: "http://hub.test" });
+    expect(headers[0]).not.toHaveProperty("x-forwarded-proto");
+  });
+
   it("never forwards the vendor shell endpoint", async () => {
     const { handler, requests } = fixture([AuthOrchestrationOperateScope]);
     expect(

apps/server/src/device/DeviceHubProxy.ts

@@ -66,6 +66,9 @@ const DROPPED_REQUEST_HEADERS = new Set([
   "dpop",
   "content-length",
   "accept-encoding",
+  // expo-device-hub takes the request origin from X-Forwarded-Proto, so a
+  // client's `https` fails serve-emu's Origin check.
+  "x-forwarded-proto",
 ]);
 
 const isWebSocketUpgrade = (request: HttpServerRequest.HttpServerRequest) =>