From 52818e50fbdf8252f4bc5cecf1d00a5dd25010b4 Mon Sep 17 00:00:00 2001
From: Leon Morival <leon.morival@gmail.com>
Date: Fri, 7 Aug 2026 13:28:25 +0200
Subject: [PATCH] feat: trusproxies

---
 bootstrap/app.php                  |  1 +
 tests/Feature/TrustedProxyTest.php | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 tests/Feature/TrustedProxyTest.php

diff --git a/bootstrap/app.php b/bootstrap/app.php
index 3f6f0ef..d989a25 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -15,6 +15,7 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->trustProxies(at: '*');
         $middleware->prepend(\App\Http\Middleware\SetLocale::class);
         $middleware->alias([
             'verified' => \App\Http\Middleware\EnsureEmailIsVerified::class,
diff --git a/tests/Feature/TrustedProxyTest.php b/tests/Feature/TrustedProxyTest.php
new file mode 100644
index 0000000..f515791
--- /dev/null
+++ b/tests/Feature/TrustedProxyTest.php
@@ -0,0 +1,19 @@
+<?php
+
+it('generates secure Filament asset URLs behind the production proxy', function () {
+    $response = $this
+        ->withServerVariables(['REMOTE_ADDR' => '10.0.0.2'])
+        ->withHeaders([
+            'X-Forwarded-Host' => 'dailyapi.leonmorival.xyz',
+            'X-Forwarded-Port' => '443',
+            'X-Forwarded-Proto' => 'https',
+        ])
+        ->get('/dashboard/login');
+
+    $response
+        ->assertOk()
+        ->assertSee(
+            'href="https://dailyapi.leonmorival.xyz/build/assets/',
+            escape: false,
+        );
+});