fix: apply custom headers by target origin, not hardcoded host

[ChiragAgg5k]

Summary

Custom headers were only applied when the request URL started with hardcoded http://appwrite/. That breaks setups where _APP_WORKER_SCREENSHOTS_ROUTER is a different internal host (e.g. http://appwrite-api on k8s).

This replaces that prefix with the origin of the request URL, so headers follow whatever host is being captured while still staying off third-party subresources.

Changes

• src/routes/screenshots.ts / src/routes/reports.ts: match against new URL(body.url).origin instead of http://appwrite/

Test plan

• Screenshot against http://appwrite-api/?appwrite-preview=1 with custom headers — headers applied
• Same page loading a third-party asset — headers not sent there
• Default Compose host http://appwrite/ still works

  

[github-actions]

Docker Image Stats

Metric	Value
Image Size	494MB
Memory Usage	156.1MiB
Cold Start Time	1.02s
Screenshot Time	4.10s

_{Screenshot benchmark: Average of 3 runs on https://appwrite.io}

[greptile-apps]

Greptile Summary

This PR applies custom headers according to the requested page’s origin. The main changes are:

• Derive the allowed origin from body.url in report requests.
• Use the same origin boundary for screenshot requests.
• Keep custom headers off requests to other origins.

Confidence Score: 5/5

This looks safe to merge.

• The target URL is validated before its origin is derived.
• The trailing slash boundary prevents matching similarly prefixed hosts.
• Redirects and subresources on other origins do not receive custom headers.
• No blocking issues were found in the changed code.

Important Files Changed

Filename	Overview
src/routes/reports.ts	Replaces the hardcoded Appwrite host check with an origin derived from the requested report URL.
src/routes/screenshots.ts	Applies screenshot headers only to requests matching the origin of the requested page.

_{Reviews (1): Last reviewed commit: "fix: apply custom headers by target orig..." | Re-trigger Greptile}