initial commit on Federted servers

web/app/(app)/settings/page.tsx

@@ -0,0 +1,24 @@
+import { SettingsClient } from './client'
+import { getOidcStatus } from '@/lib/oidc-config'
+import { headers } from 'next/headers'
+
+export const dynamic = 'force-dynamic'
+
+export default async function SettingsPage() {
+  // The redirect URI shown for Authelia registration derives from the same
+  // configured origin auth.ts trusts — never from client-controllable request
+  // headers in production (header poisoning could hand an admin an
+  // attacker-hosted callback URL to register).
+  const envUrl = process.env.NEXTAUTH_URL || process.env.AUTH_URL || ''
+  let callbackUrl = '/api/auth/callback/authelia'
+  try {
+    if (envUrl) callbackUrl = `${new URL(envUrl).origin}/api/auth/callback/authelia`
+  } catch { /* keep the relative fallback */ }
+  if (!envUrl && process.env.NODE_ENV !== 'production') {
+    const h = await headers()
+    const host = h.get('x-forwarded-host') ?? h.get('host') ?? ''
+    const proto = h.get('x-forwarded-proto') ?? 'http'
+    if (host) callbackUrl = `${proto}://${host}/api/auth/callback/authelia`
+  }
+  return <SettingsClient oidc={getOidcStatus()} callbackUrl={callbackUrl} />
+}