From 54f98387e50747e43da19f56422364a2ff810fe1 Mon Sep 17 00:00:00 2001
From: wusumac <736139669@qq.com>
Date: Sun, 2 Aug 2026 23:50:34 +0800
Subject: [PATCH] feat(web,hub): in-place connection switching via setServerUrl
 + CORS allowlist for lanUrl

---
 hub/src/config/serverSettings.ts    | 13 +++++++++++++
 hub/src/configuration.ts            |  5 +++++
 hub/src/web/server.ts               | 11 ++++++++++-
 web/src/App.tsx                     |  2 +-
 web/src/lib/app-context.tsx         |  3 +++
 web/src/routes/settings/general.tsx |  8 ++++++--
 6 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/hub/src/config/serverSettings.ts b/hub/src/config/serverSettings.ts
index 2057d8a0..6b1b76d3 100644
--- a/hub/src/config/serverSettings.ts
+++ b/hub/src/config/serverSettings.ts
@@ -21,6 +21,7 @@ export interface ServerSettings {
     listenPort: number
     publicUrl: string
     corsOrigins: string[]
+    lanUrl: string | null
 }
 
 export interface ServerSettingsResult {
@@ -33,6 +34,7 @@ export interface ServerSettingsResult {
         listenHost: 'env' | 'file' | 'default'
         listenPort: 'env' | 'file' | 'default'
         publicUrl: 'env' | 'file' | 'default'
+        lanUrl: 'file' | 'default'
         corsOrigins: 'env' | 'file' | 'default'
     }
     savedToFile: boolean
@@ -110,6 +112,7 @@ export async function loadServerSettings(dataDir: string): Promise<ServerSetting
         listenHost: 'default',
         listenPort: 'default',
         publicUrl: 'default',
+        lanUrl: 'default',
         corsOrigins: 'default',
     }
     // telegramBotToken: env > file > null
@@ -214,6 +217,15 @@ export async function loadServerSettings(dataDir: string): Promise<ServerSetting
         sources.publicUrl = 'file'
     }
 
+    // lanUrl: file only (optional alternative access URL, e.g. LAN direct)
+    let lanUrl: string | null = null
+    if (typeof settings.lanUrl === 'string' && settings.lanUrl.trim()) {
+        lanUrl = settings.lanUrl.trim()
+        sources.lanUrl = 'file'
+    } else {
+        sources.lanUrl = 'default'
+    }
+
     // corsOrigins: env > file > derived from publicUrl
     let corsOrigins: string[]
     if (process.env.CORS_ORIGINS) {
@@ -244,6 +256,7 @@ export async function loadServerSettings(dataDir: string): Promise<ServerSetting
             listenHost,
             listenPort,
             publicUrl,
+            lanUrl,
             corsOrigins,
         },
         sources,
diff --git a/hub/src/configuration.ts b/hub/src/configuration.ts
index 20779a3a..bc1eced4 100644
--- a/hub/src/configuration.ts
+++ b/hub/src/configuration.ts
@@ -40,6 +40,7 @@ export interface ConfigSources {
     listenHost: ConfigSource
     listenPort: ConfigSource
     publicUrl: ConfigSource
+    lanUrl: ConfigSource
     corsOrigins: ConfigSource
     cliApiToken: 'env' | 'file' | 'generated'
 }
@@ -87,6 +88,9 @@ class Configuration {
     /** Public URL for external access (e.g., Telegram Mini App) */
     public readonly publicUrl: string
 
+    /** Optional alternative access URL (e.g. LAN direct) */
+    public readonly lanUrl: string | null
+
     /** Allowed CORS origins for Mini App + Socket.IO (comma-separated env override) */
     public readonly corsOrigins: string[]
 
@@ -113,6 +117,7 @@ class Configuration {
         this.listenHost = serverSettings.listenHost
         this.listenPort = serverSettings.listenPort
         this.publicUrl = serverSettings.publicUrl
+        this.lanUrl = serverSettings.lanUrl
         this.corsOrigins = serverSettings.corsOrigins
 
         // CLI API token - will be set by _setCliApiToken() before create() returns
diff --git a/hub/src/web/server.ts b/hub/src/web/server.ts
index c816c050..68b6cf6b 100644
--- a/hub/src/web/server.ts
+++ b/hub/src/web/server.ts
@@ -232,7 +232,16 @@ function createWebApp(options: {
 
     const configuration = getConfiguration()
     const corsOrigins = options.corsOrigins ?? configuration.corsOrigins
-    const corsOriginOption = corsOrigins.includes('*') ? '*' : corsOrigins
+    const mergedCorsOrigins = configuration.lanUrl
+        ? (() => {
+            try {
+                return [...new Set([...corsOrigins, new URL(configuration.lanUrl).origin])]
+            } catch {
+                return corsOrigins
+            }
+        })()
+        : corsOrigins
+    const corsOriginOption = mergedCorsOrigins.includes('*') ? '*' : mergedCorsOrigins
     const corsMiddleware = cors({
         origin: corsOriginOption,
         allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
diff --git a/web/src/App.tsx b/web/src/App.tsx
index 2bccf74b..3e40a635 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -449,7 +449,7 @@ function AppInner() {
     }
 
     return (
-        <AppContextProvider value={{ api, token, baseUrl }}>
+        <AppContextProvider value={{ api, token, baseUrl, setServerUrl }}>
             <VoiceProvider>
                 <PwaUpdateBannerWithStatusOffset
                     isSyncing={isSyncing}
diff --git a/web/src/lib/app-context.tsx b/web/src/lib/app-context.tsx
index 477d9d91..6905c8df 100644
--- a/web/src/lib/app-context.tsx
+++ b/web/src/lib/app-context.tsx
@@ -1,10 +1,13 @@
 import { createContext, useContext, type ReactNode } from 'react'
 import type { ApiClient } from '@/api/client'
 
+import type { ServerUrlResult } from '@/hooks/useServerUrl'
+
 type AppContextValue = {
     api: ApiClient
     token: string
     baseUrl: string
+    setServerUrl: (input: string) => ServerUrlResult
 }
 
 const AppContext = createContext<AppContextValue | null>(null)
diff --git a/web/src/routes/settings/general.tsx b/web/src/routes/settings/general.tsx
index f14f5591..21c77939 100644
--- a/web/src/routes/settings/general.tsx
+++ b/web/src/routes/settings/general.tsx
@@ -11,7 +11,7 @@ const locales: ReadonlyArray<{ value: Locale; label: string }> = [
 
 function ConnectionSwitch() {
     const { t } = useTranslation()
-    const { api } = useAppContext()
+    const { api, setServerUrl } = useAppContext()
     const [info, setInfo] = useState<{ publicUrl: string | null; lanUrl: string | null } | null>(null)
 
     useEffect(() => {
@@ -68,7 +68,11 @@ function ConnectionSwitch() {
                     <button
                         type="button"
                         onClick={() => {
-                            window.location.href = target
+                            // Switch the hub connection in place — the app
+                            // reconnects to the target origin without a full
+                            // page navigation (same hub, so the token stays
+                            // valid).
+                            setServerUrl(target)
                         }}
                         className="shrink-0 rounded-md border border-[var(--app-border)] bg-[var(--app-subtle-bg)] px-2 py-1.5 text-xs text-[var(--app-fg)] hover:bg-[var(--app-secondary-bg)]"
                     >