fix(auth): resolve CORS errors for self-hosted deployments behind reverse proxies (#4369)

* fix(auth): resolve CORS errors for self-hosted deployments behind reverse proxies

- auth client now uses browser origin first, falling back to NEXT_PUBLIC_APP_URL
- socket client falls back to page origin when served from non-localhost (assumes /socket.io is proxied)
- add TRUSTED_ORIGINS env var to extend Better Auth trustedOrigins (apex+www, alias hostnames)
- warn at startup when NEXT_PUBLIC_APP_URL is localhost in production
- preprocess empty NEXT_PUBLIC_SOCKET_URL so docker-compose ${VAR:-} works
- migrate remaining uuid/nanoid/randomUUID usages to @sim/utils generateId/generateShortId
- extend generateShortId with optional alphabet param (rejection sampling)
- document TRUSTED_ORIGINS in .env.example, docker-compose.prod.yml, and helm values.yaml

Fixes simstudioai/sim#1243

* fix(auth): address PR review comments

* chore(env): drop unnecessary NEXT_PUBLIC_SOCKET_URL preprocess (skipValidation is true)

* fix(docker): include @sim/utils in migrations image

Migration scripts now import generateId from @sim/utils/id; without copying packages/utils into the image, bun install fails to resolve the workspace dep at build time and the import fails at runtime.

* fix(helm): remove unused NEXT_PUBLIC_SOCKET_URL from realtime sections

The realtime service never reads NEXT_PUBLIC_SOCKET_URL — its env schema
only includes BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL, ALLOWED_ORIGINS,
BETTER_AUTH_SECRET, INTERNAL_API_SECRET, DATABASE_URL, and REDIS_URL.
Remove the dead config from all helm values files and the values schema.

* fix(helm): allow empty NEXT_PUBLIC_SOCKET_URL in values schema

The default in values.yaml is now "" (empty string), which falls back to
the page origin at runtime. The schema previously required a valid URI,
which would reject the default. Mirror the INTERNAL_API_BASE_URL pattern
using anyOf with const "". Also add TRUSTED_ORIGINS to the schema.

* docs(self-hosting): mark NEXT_PUBLIC_SOCKET_URL as optional

The page-origin fallback in getSocketUrl() means self-hosters no longer
need to set NEXT_PUBLIC_SOCKET_URL when realtime is on the same origin
as the app. Update docs to reflect this:

- Remove NEXT_PUBLIC_SOCKET_URL from .env scaffolding examples in
  docker.mdx, platforms.mdx, environment-variables.mdx
- Mark the variable as Optional in the env vars table with the new
  default behavior described
- Update troubleshooting to point at reverse-proxy /socket.io routing
  rather than the env var
- Flip dev docker-compose defaults (local, ollama, devcontainer) from
  http://localhost:3002 to empty for consistency with prod.yml; the
  in-code localhost fallback handles the dev case identically

Applied across all 6 documentation languages (en/fr/de/ja/es/zh).

* chore: untrack and ignore .claude/scheduled_tasks.lock

packages/utils/src/id.test.ts

@@ -38,6 +38,17 @@ describe('generateShortId', () => {
     const ids = new Set(Array.from({ length: 100 }, () => generateShortId()))
     expect(ids.size).toBe(100)
   })
+
+  it('supports a custom alphabet', () => {
+    const alphabet = 'abcdef0123456789'
+    const id = generateShortId(32, alphabet)
+    expect(id).toHaveLength(32)
+    expect(id).toMatch(/^[a-f0-9]+$/)
+  })
+
+  it('throws for an alphabet shorter than 2 characters', () => {
+    expect(() => generateShortId(8, 'a')).toThrow()
+  })
 })
 
 describe('isValidUuid', () => {

packages/utils/src/id.ts

@@ -39,15 +39,29 @@ const URL_SAFE_ALPHABET = 'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghj
  * contexts including non-secure (HTTP) browsers.
  *
  * @param size - Length of the generated ID (default: 21)
- * @returns A URL-safe random string
+ * @param alphabet - Optional custom alphabet (replaces nanoid's `customAlphabet`).
+ *                   Length must be in [2, 256].
+ * @returns A random string drawn from the alphabet
  */
-export function generateShortId(size = 21): string {
-  const bytes = new Uint8Array(size)
-  crypto.getRandomValues(bytes)
+export function generateShortId(size = 21, alphabet: string = URL_SAFE_ALPHABET): string {
+  const alphabetLength = alphabet.length
+  if (alphabetLength < 2 || alphabetLength > 256) {
+    throw new Error('generateShortId alphabet length must be between 2 and 256')
+  }
+
+  const mask = (2 << (31 - Math.clz32((alphabetLength - 1) | 1))) - 1
+  const step = Math.ceil((1.6 * mask * size) / alphabetLength)
 
   let id = ''
-  for (let i = 0; i < size; i++) {
-    id += URL_SAFE_ALPHABET[bytes[i] & 63]
+  while (id.length < size) {
+    const bytes = new Uint8Array(step)
+    crypto.getRandomValues(bytes)
+    for (let i = 0; i < step && id.length < size; i++) {
+      const index = bytes[i] & mask
+      if (index < alphabetLength) {
+        id += alphabet[index]
+      }
+    }
   }
   return id
 }