fix(config): reject hostless addresses in single-user mode

CHANGELOG.md

@@ -32,6 +32,12 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   `code_required` (below). A server and a computer must be upgraded together: an older computer has
   no `/sign-in/code`.
 
+### No-sign-in startup rejects addresses without a host
+
+With `OPENBOT_SINGLE_USER=true`, an address such as `example.com:3010` in `OPENBOT_PUBLIC_URL`,
+`OPENBOT_APP_URL` or `TRUSTED_ORIGINS` now refuses startup. It previously counted as a private
+network address and only warned, even though the missing URL scheme left its host unidentified.
+
 ### The Bot's screen opens only when there is something to watch
 
 Asking a Bot a question it answered in words could still open its computer beside the conversation,

server/src/config.ts

@@ -560,6 +560,7 @@ function reachOf(raw: string): Reach {
     return "public";
   }
   bare = bare.replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (!bare) return "public";
 
   if (
     bare === "localhost" ||

server/tests/config.test.ts

@@ -530,6 +530,15 @@ describe("deployment configuration", () => {
       { TRUSTED_ORIGINS: "http://localhost:3010,https://openbot.example.com" },
     ],
     ["an address that is not a URL at all", { OPENBOT_PUBLIC_URL: "openbot" }],
+    [
+      "a public URL missing its scheme",
+      { OPENBOT_PUBLIC_URL: "example.com:3010" },
+    ],
+    ["an app URL missing its scheme", { OPENBOT_APP_URL: "example.com:3010" }],
+    [
+      "a trusted origin missing its scheme",
+      { TRUSTED_ORIGINS: "http://localhost:3010,example.com:3010" },
+    ],
   ])("refuses no sign-in combined with %s", (_label, published) => {
     expect(() =>
       loadConfig({ ...withoutSignIn, ...OPEN, ...published }),